6 Repositories
Rust edr-evasion Libraries
A memory-based evasion technique which makes shellcode invisible from process start to end.
phantom A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation ShellGhost Offensive Edition, and rust!
5 Sep 15, 2023
Process injection through entry points hijacking.
EPI EPI (Entry Point Injection) is a tool that leverages a new threadless process injection technique that relies on hijacking loaded dll's entry poin
208 Jun 16, 2023
some AV / EDR / analysis studies
binary some AV / EDR / analysis related experiences fault_test: trigger a access violation, catch with a custom handler and continue the normal execut
7 May 26, 2023
Detect EDR's exceptions by inspecting processes' loaded modules
Description This tool looks for either the processes that have a certain binary loaded or the processes that don't. This is useful in the following sc
89 May 7, 2023
Another approach to thread stack spoofing.
Description This Twitter thread inspired the creation of this tool. Unwinder is a PoC of how to parse PE's UNWIND_INFO structs in order to achieve "pr
132 Jan 6, 2023
Massayo is a small proof-of-concept Rust library which removes AV/EDR hooks in a given system DLL
Massayo Massayo is a small proof-of-concept Rust library based on UnhookingPOC, which removes AV/EDR hooks in a given system DLL. I tried to reduce fi
53 Dec 21, 2022