awesome-edr-bypass

Awesome EDR Bypass　

🛡️ Awesome EDR Bypass Resources For Ethical Hacking ⚔️

EDR bypass technology is not just for attackers. Many malware now have EDR bypass capabilities, knowledge that pentesters and incident responders should also be aware of. This repository is not intended to be used to escalate attacks. Use it for ethical hacking.

PoC

• trickster0/TartarusGate: TartarusGate, Bypassing EDRs
• am0nsec/HellsGate: Original C Implementation of the Hell’s Gate VX Technique
  • The paper PDF has a nice summary of EDR Bypass techniques.
• Maldev-Academy/HellHall: Performing Indirect Clean Syscalls
  • A technique called HellsGate, which specifies a system call number through a value in memory, combined with a technique to call a system call by specifying an address in NTDLL where the syscall instruction is implemented, without calling the syscall instruction.
• TheD1rkMtr/UnhookingPatch: Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime
• RedTeamOperations/Journey-to-McAfee
• op7ic/EDR-Testing-Script: Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads
• zer0condition/mhydeath: Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.
  • Demo to force quit Crowdstrike Falcon and Microsoft　Defender
• Mr-Un1k0d3r/RedTeamCCode: Red Team C code repo
• BYOSI: Bypass EDR by bringing your own script interpreter
• Polydrop: Expanded BYOSI attack, leverages 12 additional languages.
• senzee1984/EDRPrison: Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry
• S3cur3Th1sSh1t/Ruy-Lopez: Proof-of-Concept(PoC) for a new approach to completely prevent DLLs from being loaded into a newly spawned process
  • This post will cover the background and description of the technique.

Tool

• tanc7/EXOCET-AV-Evasion: EXOCET - AV-evading, undetectable, payload delivery tool
• naksyn/Pyramid: a tool to help operate in EDRs’ blind spots
• Yaxser/Backstab: A tool to kill antimalware protected processes
• klezVirus/inceptor: Template-Driven AV/EDR Evasion Framework
• georgesotiriadis/Chimera: Automated DLL Sideloading Tool With EDR Evasion Capabilities
• netero1010/EDRSilencer: A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.
• wavestone-cdt/EDRSandblast
• myzxcg/RealBlindingEDR: Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback…
• jthuraisamy/SysWhispers2: Direct system call generator to bypass userland API hooks
• klezVirus/SysWhispers3: Generate header/ASM files implants can use to make direct system calls
• d1rkmtrr/dark-kill: A user-mode code and its rootkit that will Kill EDR Processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.
• thomasxm/BOAZ_beta: Multilayered AV/EDR Evasion Framework

Workshop

More of a malware development workshop for pentesters than a workshop to Bypass EDR.

• chvancooten/maldev-for-dummies: A workshop about Malware Development
• BC-SECURITY/Beginners-Guide-to-Obfuscation
• chr0n1k/AH2021Workshop: Malware development for red teaming workshop
• WesleyWong420/RedTeamOps-Havoc-101: Materials for the workshop “Red Team Ops: Havoc 101”

Presentation

• Lifting the veil, a look at MDE under the hood - FIRST CONFERENCE 2022
• Dirty Vanity: A New Approach to Code Injection & EDR Bypass - Black Hat Europe 2022
• talks/Diego Capriotti - DEFCON30 Adversary Village - Python vs Modern Defenses.pdf
• Develop Your Own Rat
• EDR Evasion Primer for Red Teamers - Karsten Nohl & Jorge Gimenez - Hack in the Box 2022 Singapore
• EDR Reloaded: Erase Data Remotely - Black Hat Asia 2024 | Briefings Schedule
• EvilEDR: Repurposing EDR as an Offensive Tool - USENIX Security 2025
  • Demonstrates how EDR systems can be employed for offensive use, executing arbitrary commands, exfiltrating data, and impairing defenses. Artifact repository is hosted on the Zenodo platform and is publicly accessible through the following permanent URL:https://doi.org/10.5281/zenodo.15116409
• Hiding Payloads in Plain .text, bypass EDRs which use Shannon entropy for detection - x33fcon 2024
  • code repository for this Presentation
  • some blogs relative to this topic:
    • https://redsiege.com/blog/2023/04/evading-crowdstrike-falcon-using-entropy/
    • https://redops.at/en/blog/meterpreter-vs-modern-edrs-in-2023
    • https://practicalsecurityanalytics.com/file-entropy/

Blog

• Living-Off-the-Blindspot - Operating into EDRs’ blindspot | Naksyn’s blog
  • Type of person who works hard in Python; uses PEP 578 – Python Runtime Audit Hooks.
• Bypass CrowdStrike Falcon EDR protection against process dump like lsass.exe | by bilal al-qurneh | Medium
  • The story is that a forensic tool can be used to dump memory without detection. This is an example of how a tool for legitimate purposes that is not an attack tool can be used in an attack without being detected.
• Bypassing CrowdStrike Falcon and MDE
• State-of-the-art EDRs are not perfect, fail to detect common attacks - The Record from Recorded Future News
  • Commentary on An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors
• A tale of EDR bypass methods | S3cur3Th1sSh1t
• Blindside: A New Technique for EDR Evasion with Hardware Breakpoints - Cymulate
• Attacking an EDR - Part 1
• Attacking an EDR - Part 2
• The Dark Side of EDR: Repurpose EDR as an Offensive Tool | SafeBreach
  • Probably the same content as The Dark Side of EDR: Repurpose EDR as an Offensive Tool - Black Hat Asia 2024
  • Focusing on Palo Alto Networks’ Cortex XDR, the report presents a case study of how EDR turned into a stealthy and unique persistent malware.
• Silent Threat: Red Team Tool EDRSilencer Disrupting Endpoint Security Solutions | Trend Micro (US)
  • Leveraging the Windows Filtering Platform (WFP)
• Bring Your Own Installer: Bypassing EDR Through Agent Version Change Interruption
  • Running the EDR installer locally stops the EDR process.
• Meterpreter vs Modern EDR(s) - RedOps
• Blinding EDR On Windows | synzack
  • Detailed explanation of Windows kernel callbacks, how EDRs work, and techniques to remove EDR visibility
• Silencing the EDR Silencers | Huntress
  • Defense perspective on protecting EDRs from blinding attacks using firewall and WFP rules

BYOVD

• EDR Bypass Testing Reveals Extortion Actor’s Toolkit
• Forget vulnerable drivers - Admin is all you need — Elastic Security Labs
• Bring Your Own Backdoor: How Vulnerable Drivers Let Hackers In - VMware Security Blog - VMware
• It’ll be back: Attackers still abusing Terminator tool and variants – Sophos News
• Bypassing EDR through Retrosigned Drivers and System Time Manipulation
  • Retrosigned Drivers extends previous techniques by altering the system clock on the target system to load malicious kernel drivers that were signed by historically compromised expired cross-signing certificates.
• ThanniKudam/TopazTerminator: Just another EDR killer
  • PoC

Sandbox / Container

• Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945 | Mandiant | Google Cloud Blog
• Bring Your Own Container: When Containers Turn the Key to EDR Bypass - Speaker Deck
• Hack The Sandbox: Unveiling the Truth Behind Disappearing Artifacts | JSAC 2025

macOS

• EDR Internals for macOS and Linux | Outflank Security Blog
• In-Memory Execution in macOS: the Old and the New | Meta Red Team X

Book

• Evading EDR | No Starch Press

Other awesome series

• MrEmpy/Awesome-AV-EDR-XDR-Bypass: Awesome AV/EDR/XDR Bypass Tips