edr-bypass · GitHub Topics

Template-Driven AV/EDR Evasion Framework

obfuscation pinvoke dinvoke code-injection process-injection av-bypass amsi-bypass av-evasion edr-bypass pe-packer amsi-evasion red-team red-teaming av-edr-bypass payload-generator

Assembly 1.69 k

2 年前

tkmru / awesome-edr-bypass

Awesome EDR Bypass Resources For Ethical Hacking

Awesome Lists edr edr-bypass redteam redteaming

1.21 k

10 天前

NUL0x4C / AtomPePacker

A Highly capable Pe Packer

edr-bypass packer pe

C 703

3 年前

thomasxm / BOAZ_beta

Multilayered AV/EDR Evasion Framework

boaz code-injection obfuscation av-bypass av-edr-bypass av-evasion edr-bypass etw-bypass payload-generator pe-packer process-injection red-teaming red-teaming-tools red-ream antivirus-evasion

C++ 683

1 个月前

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls Shell

C 666

24 天前

georgesotiriadis / Chimera

Automated DLL Sideloading Tool With EDR Evasion Capabilities

Assembly C++edr-bypass offensive-security Python

Python 477

1 年前

WesleyWong420 / RedTeamOps-Havoc-101

Materials for the workshop "Red Team Ops: Havoc 101"

active-directory av-evasion edr-bypass opsec process-injection red-team-ops havoc

C# 378

8 个月前

f1zm0 / acheron

indirect syscalls for AV/EDR evasion in Go assembly

evasion adversary-emulation av-evasion edr-bypass edr-evasion malware-research offensive-security red-team red-teaming Assembly Go

Assembly 329

2 年前

Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

avbypass edr-bypass fud malware-development Shell

C++ 285

1 年前

V-i-x-x / AMSI-WRITE-RAID-BYPASS

"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS

0day amsi-bypass amsi-evasion amsi-patch av avbypass edr-bypass vulnerability pentest pentesting Malware

PowerShell 284

2 个月前

VirtualAlllocEx / Create-Thread-Shellcode-Fetcher

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)...

shellcode-loader shellcode-injection antivirus-evasion edr-bypass msfvenom bypass-antivirus

C++ 247

2 年前

fortra / hw-call-stack

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

edr-bypass stack-spoofing syscalls

C 196

1 年前

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader

C 194

1 年前

dobin / antnium

A C2 framework for initial access in Go

c2 edr-bypass initial-access rat remote-access

Go 184

3 年前

V-i-x-x / kernel-callback-removal

kernel callback removal (Bypassing EDR Detections)

edr edr-bypass edr-evasion Kernel

C++ 172

3 个月前

oldkingcone / BYOSI

Evade EDR's the simple way, by not touching any of the API's they hook.

edr-bypass edr-evasion PHP PowerShell redteam

PHP 145

5 个月前

mrexodia / lolbin-poc

Small PoC of using a Microsoft signed executable as a lolbin.

edr-bypass Malware poc redteam redteam-tools redteaming windbg windbg-extension

C++ 137

2 年前

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion

C 133

2 年前

njcve / inflate.py

Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.

antivirus antivirus-evasion av-bypass av-evasion Bug Bounty edr-bypass endpoint-security evasion-attack

Python 120

3 年前

voidvxvt / HellBunny

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

direct-syscalls edr-evasion indirect-syscalls malware-development msvc Windows process-injection edr-bypass dll shellcode-injection shellcode-loader

C 107

6 个月前