edr-evasion

Little user-mode AV/EDR evasion lab for training & learning purposes

PoC Implementation of a fully dynamic call stack spoofer

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

.NET/PowerShell/VBA Offensive Security Obfuscator

C++ self-Injecting dropper based on various EDR evasion techniques.

Call stack spoofing for Rust

pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged