Topic: edr Goto Github

👇 Here are 128 public repositories matching this topic...

0xrawsec / whids
edr,Open Source EDR for Windows
Organization: 0xrawsec
Home Page: https://rawsec.lu
dfir threat-hunting windows ids sysmon edr

ars3n11 / minesweeper
edr,Windows user-land hooks manipulation tool.
User: ars3n11
hooks edr windows unhooking

bytedance / elkeid
edr,Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.
Organization: bytedance
Home Page: https://elkeid.bytedance.com
hids security rasp edr cwpp linux-security

carbonblack / cbapi-python
edr,Carbon Black API - Python language bindings
Organization: carbonblack
cbapi carbonblack api-wrapper python-bindings python carbon-black-cloud cb-defense cb-threathunter cb-liveops cb-protection

georgepatsias / scarecrow-cobaltstrike
edr,Cobalt Strike script for ScareCrow payloads intergration (EDR/AV evasion)
User: georgepatsias
cobaltstrike-cna edr scarecrow bypass-antivirus evasion dll exe wscript msiexec control

gmatuz / npm-initial-access
edr,Easy to extend initial access scenario to help with EDR testing on Linux and Mac
User: gmatuz
Home Page: https://medium.com/@matuzg/testing-edrs-for-linux-things-i-wish-i-knew-before-getting-started-3ab15112c183
redteaming pentesting edr cybersecurity tooling testing edr-testing red-team red-teaming mitre-attack

huoji120 / ducksyseye
edr,SysEye是一个window上的基于att&ck现代EDR设计**的威胁响应工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
User: huoji120
edr osquery sysmon threat-hunting threat-modeling

ion-storm / sysmon-edr
edr,Sysmon EDR POC Build within Powershell to prove ability.
User: ion-storm
edr sysmon sysmon-edr

ion28 / bluespawn
edr,An Active Defense and EDR software to empower Blue Teams
User: ion28
active-defense windows security security-tools blue-team mitre-attack anti-virus edr threat-hunting

jthuraisamy / telemetrysourcerer
edr,Enumerate and disable common sources of telemetry used by AV/EDR.
User: jthuraisamy
av edr evasion security-tools

kara-4search / earlybirdinjection_csharp
edr,Inject shellcode into process via "EarlyBird"
User: kara-4search
earlybird shellcode injection process-injection edr redteam csharp bypass apc

kara-4search / hookdetection_csharp
edr,HookDetection
User: kara-4search
hookdetect windows-defender edr redteam redteam-tools pentest hook-functions csharp

kara-4search / peb-ppidspoofing_csharp
edr,Command line & PPID spoofing
User: kara-4search
bypass sysmon csharp edr redteam pentest ppid avatar

kiding / wanna-see-a-whiter-white
edr,CSS trick/bug to display a brighter white by exploiting browsers' HDR capability and Apple's EDR system
User: kiding
Home Page: https://fff.kidi.ng
css hdr edr apple

learningkijo / kql
edr,Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.
User: learningkijo
kql threat-hunting edr xdr incident-response kusto

learningkijo / mdetester
edr,MDE Tester is designed to help testing various features in Microsoft Defender for Endpoint.
User: learningkijo
edr powershell testing defenderforendpoint

matro7sh / bypassav
edr,This map lists the essential techniques to bypass anti-virus and EDR
Organization: matro7sh
Home Page: https://matro7sh.github.io/BypassAV/
av bypass edr mindmap pentest redteam markdown

mrempy / condor
edr,「🛡️」AVs/EDRs Evasion tool
User: mrempy
antivirus antivirus-evasion av bypass defender edr evasion hacking injection loader

naksyn / pyramid
edr,a tool to help operate in EDRs' blind spots
User: naksyn
edr edr-testing hacking python redteam-tools redteaming

nasbench / sedr-internals
edr,Symantec EDR Internals
User: nasbench
edr detection internals endpoint symantec sedr endpoint-detection-response windows

niklasr22 / brightintosh
edr,Unlock the full brightness of the XDR display of your MacBook Pro
User: niklasr22
Home Page: https://brightintosh.de/
brightness hdr macbook macbook-pro macos xdr apple bright brightness-control display

nul0x4c / knowndllunhook
edr,Replace the .txt section of the current loaded modules from \KnownDlls\ to bypass edrs
User: nul0x4c
bypass edr

op7ic / edr-testing-script
edr,Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads
User: op7ic
edr mitre att security-audit security edr-solutions incident-response

processust / unhookingdll
edr,This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing
User: processust
bypass dll-unhooking edr etw process-hollowing shellcode

processust / venoma
edr,Yet another C++ Cobalt Strike beacon dropper with Compile-Time API hashing and custom indirect syscalls execution
User: processust
Home Page: https://processus.site
antivirus bypass c2 cobalt dropper edr malware payload pentest red

rabbitstack / fibratus
edr,A modern tool for Windows kernel exploration and tracing with a focus on security
User: rabbitstack
Home Page: https://www.fibratus.io
windows windows-kernel instrumentation python golang security edr

redcanaryco / redcanary-response-utils
edr,Tools to automate and/or expedite response.
Organization: redcanaryco
security-tools edr

reveng007 / reflectiventdll
edr,A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
User: reveng007
antivirus dropper edr evasion fiber implant malware ntdll-unhooking systemfunction033 process-injection

roomasec / rmeye
edr,戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
User: roomasec
edr sysmon threat-hunting

securityjoes / forensicminer
edr,A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
Organization: securityjoes
Home Page: http://github.com/YosfanEilay
automation cortex crowdstrike cyber dfir edr fast forensics ir mdr

shadawck / awesome-endpoint-detection-and-response
edr,Collection of tool you need to have in your Endpoint Detection and Response arsenal
User: shadawck
awesome awesome-list edr endpoint endpoint-protection endpoint-security incident-response

simrail / edr
edr,EDR timetable & driver view for Simrail
Organization: simrail
Home Page: https://edr.simrail.app
edr game simrail

sitincloud / owlyshield
edr,Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).
Organization: sitincloud
Home Page: https://www.sitincloud.com
cybersecurity antivirus behavior-analysis ransomware edr machine-learning malware malware-analysis malware-research threat-hunting

starkdmi / brightxdr
edr,Free and Open Source alternative to Vivid macOS application to extend Apple XDR display brightness from 500 up to 1600 nits.
User: starkdmi
brightness display edr hdr macos swift swiftui xdr vivid lunar

th3xace / edr-test
edr,Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].
User: th3xace
aggressor-scripts cobalt-strike cobaltstrike edr purple-team purpleteam mitre-attack

tkmru / awesome-edr-bypass
edr,Awesome EDR Bypass Resources For Ethical Hacking
User: tkmru
awesome-lists edr edr-bypass

trellix-enterprise / rts-queries
edr,Practical Orientation Of MVISION EDR Query Language
Organization: trellix-enterprise
mvision-edr mvision rts real-time-search edr hunting collectors soc blue-team

tstromberg / ttp-bench
edr,Adversary emulation for EDR/SIEM testing (macOS/Linux)
User: tstromberg
ioc ids edr intrusion benchmark security ttp

tsuzukihashi / edr_swift
edr,I want to use EDR features easily.
User: tsuzukihashi
edr qrcode swiftui

uncoderio / roota
edr,Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with standardized metadata and threat intelligence to enable automated translation into other languages
User: uncoderio
Home Page: https://roota.io
datalake edr roota siem xdr rootalanguage

uncoderio / uncoder_io
edr,An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.
User: uncoderio
Home Page: https://uncoder.io
datalake edr roota siem sigma threathunting translation xdr uncoder uncoderio

utmstack / utmstack
edr,Customizable SIEM and XDR powered by Real-Time correlation and Threat Intelligence
Organization: utmstack
Home Page: https://utmstack.com
compliance correlation edr incident-response log-management siem threat-intelligence threat-management utmstack xdr

wecooperate / imonitor
edr,iMonitor（冰镜 - 终端行为分析系统）
User: wecooperate
Home Page: https://imonitorsdk.com/imonitor
procmon systemmonitor edr open-procmon malware-analysis reverse-engineering

wecooperate / imonitorsdk
edr,系统监控开发套件（sysmon、procmon、edr、终端安全、主机安全、零信任、上网行为管理、沙箱）
User: wecooperate
Home Page: https://imonitorsdk.com/
sysmon defender edr security procmon endpoint-security monitoring-tool etw kernel zero-trust

whitebeamsec / whitebeam
edr,WhiteBeam: Transparent endpoint security
Organization: whitebeamsec
application-whitelisting edr epp rust security security-hardening whitelisting

xacone / bestedrofthemarket
edr,Little user-mode AV/EDR evasion lab for training & learning purposes
User: xacone
Home Page: https://xacone.github.io/BestEdrOfTheMarketV2.html
edr defense-evasion edr-evasion edr-testing

xuanxuan0 / driploader
edr,Evasive shellcode loader for bypassing event-based injection detection (PoC)
User: xuanxuan0
Home Page: https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
shellcode shellcode-loader shellcode-injector edr evasion-attacks

xuanxuan0 / tietwagent
edr,PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
User: xuanxuan0
Home Page: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection
detection security injection edr memory-scanning

yardenshafir / conference_talks
edr,Slides from various conference talks
User: yardenshafir
conference-talk edr exploitation mitigation windows windows-internals

zeroperil / hookdump
edr,Security product hook detection
Organization: zeroperil
Home Page: https://zeroperil.co.uk/hookdump/
edr hooking redteam-tools