edr-bypass 开源项目推荐（112 个）

klezVirus /inceptor

Template-Driven AV/EDR Evasion Framework

tkmru /awesome-edr-bypass

Awesome EDR Bypass Resources For Ethical Hacking

thomasxm /BOAZ_beta

Multilayered AV/EDR Evasion Framework (no longer actively maintained)

VirtualAlllocEx /DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

georgesotiriadis /Chimera

Automated DLL Sideloading Tool With EDR Evasion Capabilities

MaorSabag /TrueSightKiller

AV/EDR killer leveraging vulnerable kernel drivers

WesleyWong420 /RedTeamOps-Havoc-101

Materials for the workshop "Red Team Ops: Havoc 101"

f1zm0 /acheron

indirect syscalls for AV/EDR evasion in Go assembly

zero2504 /EDR-GhostLocker

基于AppLocker的EDR中和

V-i-x-x /AMSI-WRITE-RAID-BYPASS

"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS

Offensive-Panda /RWX_MEMEORY_HUNT_AND_INJECTION_DV

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

redteamfortress /PhantomKiller

Another BYOVD process killer. works on all EDR's. fully signed.

AabyssZG /HashDump-BypassEDR

Windows绕过EDR实现DumpHash

VirtualAlllocEx /Create-Thread-Shellcode-Fetcher

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.

VirtualAlllocEx /Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

V-i-x-x /kernel-callback-removal

kernel callback removal (Bypassing EDR Detections)

fortra /hw-call-stack

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

oldkingcone /BYOSI

Evade EDR's the simple way, by not touching any of the API's they hook.

dobin /antnium

A C2 framework for initial access in Go

0xsh3llf1r3 /ColdWer

Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass