Search Results - RepositoryStats

BestEdrOfTheMarket Xacone

120

1.1k

mit

16

AV/EDR Evasion Lab for Training & Learning Purposes

edr edr-evasion edr-testing kernel-driver defense-evasion kernel-development

Created 2023-11-12

114 commits to main branch, last one 14 days ago

SilentMoonwalk klezVirus

96

734

bsd-3-clause

12

PoC Implementation of a fully dynamic call stack spoofer

av-evasion edr-evasion thread-stack stack-spoofing

Created 2022-12-04

8 commits to master branch, last one 6 months ago

DEFCON-31-Syscalls-Workshop VirtualAlllocEx

94

647

unknown

11

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

syscalls workshop shellcode edr-bypass edr-evasion direct-syscalls antivirus-bypass malware-analysis shellcode-loader antivirus-evasion indirect-syscalls windows-internals malware-development malware-development-guide

Created 2023-04-30

1,148 commits to main branch, last one about a year ago

Codecepticon Accenture

96

480

mit

10

.NET/PowerShell/VBA Offensive Security Obfuscator

vba csharp powershell edr-evasion obfuscation antivirus-evasion accenture-security

This repository has been archived (exclude archived)

Created 2022-08-10

25 commits to main branch, last one about a year ago

CallstackSpoofingPOC pard0p

66

367

mit

4

C++ self-Injecting dropper based on various EDR evasion techniques.

dropper av-evasion edr-evasion indirect-syscall

Created 2023-10-08

20 commits to main branch, last one 11 months ago

hades f1zm0

46

361

gpl-3.0

8

Go shellcode loader that combines multiple evasion techniques

ntapi ntdll golang evasion syscalls av-evasion pentesting edr-evasion red-teaming offensive-security adversary-emulation

Created 2022-10-11

49 commits to main branch, last one about a year ago

EPI Kudaes

34

339

other

5

Threadless Process Injection through entry point hijacking

rust hacking redteam windows edr-evasion

Created 2023-05-29

38 commits to main branch, last one 4 months ago

acheron f1zm0

38

320

mit

6

indirect syscalls for AV/EDR evasion in Go assembly

go golang evasion assembly red-team av-evasion edr-bypass edr-evasion red-teaming malware-research offensive-security adversary-emulation

Created 2023-04-07

68 commits to main branch, last one about a year ago

Unwinder Kudaes

35

309

mit

6

Call stack spoofing for Rust

rust edr-evasion hacking-tool

Created 2022-11-21

40 commits to main branch, last one 5 months ago

PythonMemoryModule naksyn

47

307

apache-2.0

5

pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory

runpe python evasion hacking redteam redteaming edr-evasion memorymodule memory-module redteam-tools

Created 2023-01-05

13 commits to main branch, last one about a year ago

Split Kudaes

27

278

mit

5

Apply a divide and conquer approach to bypass EDRs

fork rust windows edr-evasion

Created 2023-02-19

14 commits to main branch, last one about a year ago

Payload-Download-Cradles VirtualAlllocEx

51

255

unknown

3

This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.

payload bypass-edr edr-evasion bypass-antivirus antivirus-evasion

Created 2021-05-14

61 commits to main branch, last one 2 years ago

DojoLoader naksyn

43

191

apache-2.0

6

Generic PE loader for fast prototyping evasion techniques

evasion pe-loader edr-evasion red-teaming cobalt-strike red-team-tools sleep-obfuscation

Created 2024-06-30

4 commits to main branch, last one 7 months ago

Direct-Syscalls-vs-Indirect-Syscalls VirtualAlllocEx

23

173

unknown

5

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

av-bypass av-evasion edr-bypass edr-evasion windows-int direct-syscalls shellcode-loader indirect-syscalls

Created 2023-05-23

10 commits to main branch, last one about a year ago

Direct-Syscalls-A-journey-from-high-to-low VirtualAlllocEx

22

133

unknown

4

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-04-14

17 commits to main branch, last one about a year ago

sysplant x42en

12

122

gpl-3.0

5

Your syscall factory

windows syscalls edr-evasion hacking-tool code-generation syscall-hooking offensive-security

Created 2023-07-09

245 commits to main branch, last one 4 months ago

Embedder naksyn

13

115

apache-2.0

4

Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies

pyramid embedding redteaming edr-evasion

Created 2023-07-13

11 commits to main branch, last one 8 months ago

SyscallMeMaybe oldboy21

15

95

mit

4

Implementation of Indirect Syscall technique to pop a calc.exe

syscalls cplusplus edr-evasion security-tools

Created 2024-01-25

6 commits to main branch, last one about a year ago

DefenseEvasionTechniques Offensive-Panda

15

94

unknown

3

This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead in the field. It provides a valuable resource for those dedica...

edr-evasion malware-research offensivesecurity malware-development cyber-threat-intelligence

Created 2024-01-28

246 commits to main branch, last one 12 days ago

Taskschedule-Persistence-Download-Cradles VirtualAlllocEx

22

86

unknown

4

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

payload bypass-edr edr-evasion bypass-antivirus antivirus-evasion

Created 2022-03-25

44 commits to main branch, last one 2 years ago

BYOSI oldkingcone

10

80

mit

1

Evade EDR's the simple way, by not touching any of the API's they hook.

php redteam edr-bypass powershell edr-evasion

Created 2024-04-28

18 commits to main branch, last one 4 days ago

HellBunny voidvxvt

15

77

unknown

3

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

dll msvc ntapi maldev windows edr-bypass native-api api-hashing edr-evasion iat-camouflage direct-syscalls dll-sideloading shellcode-loader indirect-syscalls process-injection payload-encryption malware-development shellcode-injection

Created 2024-12-15

1 commits to main branch, last one about a month ago

BadExclusionsNWBO iamagarre

12

73

unknown

1

BadExclusionsNWBO is an evolution from BadExclusions to identify folder custom or undocumented exclusions on AV/EDR

hacking redteam pentesting edr-evasion

Created 2023-07-10

19 commits to main branch, last one 12 months ago

DSC_SVC_REMOTE VirtualAlllocEx

11

51

unknown

3

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service p...

av-bypass av-evasion edr-bypass edr-evasion direct-syscalls

Created 2023-05-08

12 commits to main branch, last one about a year ago

PichichiH0ll0wer itaymigdal

11

49

mit

4

Nim process hollowing loader

runpe loader red-team syscalls pe-loader edr-bypass edr-evasion red-team-tools payload-injector payload-generator process-hollowing process-injection penetration-testing penetration-testing-tools

Created 2023-04-15

123 commits to main branch, last one 6 months ago

Rust-Hells-Gate 0xflux

5

30

unknown

1

Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust

rust malware pentest redteam hellsgate rust-lang bypass-edr edr-bypass hells-gate pentesting redteaming edr-evasion pentest-tool redteam-tools antivirus-bypass bypass-antivirus malware-research antivirus-evasion offensive-security

Created 2024-05-18

29 commits to master branch, last one 8 months ago

CobaltStrike-YARA-Bypass-f0b627fc WafflesExploits

4

27

apache-2.0

1

Repository of scripts from my blog post on bypassing the YARA rule Windows_Trojan_CobaltStrike_f0b627fc by generating alternative shellcode sequences.

python edr-bypass yara-rules edr-evasion cobalt-strike automatization

Created 2024-10-16

6 commits to main branch, last one 3 months ago