av-bypass 开源项目推荐（68 个）

ayoubfaouzi /al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

klezVirus /inceptor

Template-Driven AV/EDR Evasion Framework

thomasxm /BOAZ_beta

Multilayered AV/EDR Evasion Framework (no longer actively maintained)

hlldz /SpookFlare

Loader, dropper generator with multiple features for bypassing client-side and network-side countermeasures.

alphaSeclab /anti-av

Resources About Anti-Virus and Anti-Anti-Virus, including 200+ tools and 1300+ posts

yutianqaq /AVEvasionCraftOnline

An online AV evasion platform written in Springboot (Golang, Nim, C) supports embedded, local and remote loading of Shellocde methods.

NoahOksuz /OSRipper

AV evading cross platform Backdoor and Crypter Framework with a integrated lightweight webUI

VirtualAlllocEx /Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

Cipher7 /ChaiLdr

AV bypass while you sip your Chai!

0xsh3llf1r3 /ColdWer

Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass

VirtualAlllocEx /Direct-Syscalls-A-journey-from-high-to-low

该项目在 GitHub 上没有填写描述

njcve /inflate.py

Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.

Sn1r /Nim-Reverse-Shell

A simple and stealthy reverse shell written in Nim that bypasses Windows Defender detection. This tool allows you to establish a reverse shell connection with a target system. Use responsibly for educational purposes only.

X-3306 /Project-Onyx

Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage.

Cipher7 /ApexLdr

ApexLdr is a DLL Payload Loader written in C

DeathShotXD /0xM0nCrush

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

CroodSolutions /AutoPwnKey

AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.

Sakura529 /BypassAV

通过Patch白文件实现免杀

hwbp /NTDLL-Unhook

proper ntdll .text section unhooking via native api. unlike other unhookers this doesnt leave 2 ntdlls loaded. x86/x64/wow64 supported.

VirtualAlllocEx /DSC_SVC_REMOTE

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.