Remotely predicts identifies the presence of EDR/XDR solutions on networks
-
Updated
Nov 7, 2024 - Go
Remotely predicts identifies the presence of EDR/XDR solutions on networks
Titan Secure Updates: Latest crypter news, software updates.
Repository to publish your evasion techniques and contribute to the project
Red Teaming Tactics and Techniques
EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.
Tool That Injects Shell via Remote Thread Hijacking
🔭 Warping your own Internet everywhere you go 📡
Rust DLL Search Order Hijacking
Custom binary file packer/encoder with integrated decoder stub. A pentest-tool for modern EDR evasion.
Carbon Crypter / Packer
Rust based process injection tool
Kraken Crypter v5 (Native/Turbo)
Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process
Whenever PowerShell is launched, Notepad will also open. You can customize the script for educational purposes, but I emphasize that I do not take any responsibility for its use or any actions taken.
NTAPI hook bypass with (semi) legit stack trace
An (WIP) EDR Evasion tool for x64 Windows & Linux binaries that utilizes Nanomites, written in Rust.
Repository of scripts from my blog post on bypassing the YARA rule Windows_Trojan_CobaltStrike_f0b627fc by generating alternative shellcode sequences.
This exploit use PEB walk technique to resolve API calls dynamically, obfuscate all API calls to perform process injection.
An advanced tool for bypassing EDR (Endpoint Detection and Response) systems and antivirus software by dynamically generating and injecting shellcode
A dynamic HTTP/s Payload Stager that automates updating decryption variables, saving time and effort in managing shellcode loaders.
Add a description, image, and links to the edr-bypass topic page so that developers can more easily learn about it.
To associate your repository with the edr-bypass topic, visit your repo's landing page and select "manage topics."