Template-Driven AV/EDR Evasion Framework

Awesome EDR Bypass Resources For Ethical Hacking

Multilayered AV/EDR Evasion Framework

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

Automated DLL Sideloading Tool With EDR Evasion Capabilities

Materials for the workshop "Red Team Ops: Havoc 101"

indirect syscalls for AV/EDR evasion in Go assembly

AppLocker-Based EDR Neutralization

"AMSI WRITE RAID" Vulnerability that leads to an effective AMSI BYPASS

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

This POC gives you the possibility to compile a .exe to completely avoid statically detection by AV/EPP/EDR of your C2-shellcode and download and execute your C2-shellcode which is hosted on your (C2)-webserver.

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

kernel callback removal (Bypassing EDR Detections)

PoC exploit for the vulnerable WatchDog Anti-Malware driver (amsdk.sys) – weaponized to kill protected EDR/AV processes via BYOVD.

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

A C2 framework for initial access in Go

Evade EDR's the simple way, by not touching any of the API's they hook.

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

Small PoC of using a Microsoft signed executable as a lolbin.

Shellcode loader written in C and Assembly utilizing direct or indirect syscalls to evade UM EDR hooks

Your Windows syscall hooking factory - feat Canterlot's Gate - All accessible over MCP

Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.

Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass

AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.

A Blind EDR Project for Educational Purposes

BeaconatorC2 is a framework for red teaming and adversarial emulation, providing a full-featured management interface, along with a catalog of beacons and a clear schema to add more beacons over time.

Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust

A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.

PowerJoker is a Python program which generate a Dynamic PowerShell Reverse-Shell Generator; Unique Payloads with different results on Each Execution.

Fairy Law - Compromise or disable EDR security solutions