edr-bypass · GitHub Topics

Template-Driven AV/EDR Evasion Framework

翻译 - 模板驱动的 AV / EDR 规避框架

obfuscation pinvoke dinvoke code-injection process-injection av-bypass amsi-bypass av-evasion edr-bypass pe-packer amsi-evasion red-team red-teaming av-edr-bypass payload-generator

Assembly 1.65 k

1 年前

tkmru / awesome-edr-bypass

Awesome EDR Bypass Resources For Ethical Hacking

Awesome Lists edr edr-bypass redteam redteaming

1.11 k

1 个月前

NUL0x4C / AtomPePacker

A Highly capable Pe Packer

edr-bypass packer pe

C 690

2 年前

VirtualAlllocEx / DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

antivirus-bypass antivirus-evasion edr-bypass edr-evasion malware-development windows-internals direct-syscalls indirect-syscalls malware-analysis malware-development-guide workshop shellcode-loader syscalls Shell

C 650

1 年前

thomasxm / BOAZ_beta

Multilayered AV/EDR Evasion Framework

boaz code-injection obfuscation av-bypass av-edr-bypass av-evasion edr-bypass etw-bypass payload-generator pe-packer process-injection red-teaming red-teaming-tools red-ream antivirus-evasion

C++ 510

2 天前

georgesotiriadis / Chimera

Automated DLL Sideloading Tool With EDR Evasion Capabilities

Assembly C++edr-bypass offensive-security Python

Python 472

1 年前

WesleyWong420 / RedTeamOps-Havoc-101

Materials for the workshop "Red Team Ops: Havoc 101"

active-directory av-evasion edr-bypass opsec process-injection red-team-ops havoc

C# 366

5 个月前

f1zm0 / acheron

indirect syscalls for AV/EDR evasion in Go assembly

evasion adversary-emulation av-evasion edr-bypass edr-evasion malware-research offensive-security red-team red-teaming Assembly Go

Assembly 326

2 年前

Offensive-Panda / RWX_MEMEORY_HUNT_AND_INJECTION_DV

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

avbypass edr-bypass fud malware-development Shell

C++ 275

9 个月前

V-i-x-x / AMSI-BYPASS

"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS

0day amsi-bypass amsi-evasion amsi-patch av avbypass edr-bypass vulnerability pentest pentesting Malware

PowerShell 252

24 天前

VirtualAlllocEx / Create-Thread-Shellcode-Fetcher

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)...

shellcode-loader shellcode-injection antivirus-evasion edr-bypass msfvenom bypass-antivirus

C++ 246

2 年前

fortra / hw-call-stack

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

edr-bypass stack-spoofing syscalls

C 187

9 个月前

VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion indirect-syscalls shellcode-loader

C 178

1 年前

dobin / antnium

A C2 framework for initial access in Go

c2 edr-bypass initial-access rat remote-access

Go 177

3 年前

mrexodia / lolbin-poc

Small PoC of using a Microsoft signed executable as a lolbin.

edr-bypass Malware poc redteam redteam-tools redteaming windbg windbg-extension

C++ 135

2 年前

VirtualAlllocEx / Direct-Syscalls-A-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion direct-syscalls edr-bypass edr-evasion

C 133

2 年前

njcve / inflate.py

Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.

antivirus antivirus-evasion av-bypass av-evasion Bug Bounty edr-bypass endpoint-security evasion-attack

Python 119

3 年前

oldkingcone / BYOSI

Evade EDR's the simple way, by not touching any of the API's they hook.

edr-bypass edr-evasion PHP PowerShell redteam

PHP 85

1 个月前

voidvxvt / HellBunny

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

direct-syscalls edr-evasion indirect-syscalls malware-development msvc Windows process-injection edr-bypass dll shellcode-injection shellcode-loader

C 82

3 个月前

itaymigdal / PichichiH0ll0wer

Nim process hollowing loader

loader pe-loader penetration-testing penetration-testing-tools process-hollowing process-injection red-team red-team-tools syscalls payload-generator runpe edr-bypass edr-evasion

Nim 56

7 个月前