edr 开源项目推荐（735 个）

matro7sh /BypassAV

此地图列出了绕过防病毒和EDR的基本技术

bytedance /Elkeid

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.

tkmru /awesome-edr-bypass

Awesome EDR Bypass Resources For Ethical Hacking

Xacone /BestEdrOfTheMarket

EDR Lab for Experimentation Purposes

ION28 /BLUESPAWN

An Active Defense and EDR software to empower Blue Teams

0xrawsec /whids

Open Source EDR for Windows

jthuraisamy /TelemetrySourcerer

Enumerate and disable common sources of telemetry used by AV/EDR.

wecooperate /iMonitor

iMonitor（冰镜 - 终端行为分析系统）

xuanxuan0 /DripLoader

用于绕过基于事件的注入检测（RST）的规避外壳代码加载器

aixisstudio /Snitch

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

naksyn /Pyramid

a tool to help operate in EDRs' blind spots

cyberblu3s /CyberBlue

网络安全蓝队容器化平台，整合了开源工具，涵盖SIEM、DFIR、CTI、SOAR和网络分析

0xflux /Sanctum

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

niklasr22 /BrightIntosh

Unlock the full brightness of the XDR display of your MacBook Pro

RoomaSec /RmEye

戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑

Karib0u /rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

LearningKijo /KQL

Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.

GeorgePatsias /ScareCrow-CobaltStrike

ScareCrow有效载荷整合（EDR/AV规避）的Cobalt Strike脚本

SitinCloud /Owlyshield

Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).

wecooperate /iMonitorSDK

The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能， 而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发