maliceio/malice: VirusTotal Wanna Be - Now with 100% more Hipster
November 24, 2021 at 2:33:29 PM UTC - permalink -

- https://github.com/maliceio/malice

Evading EDR in 15 Minutes with ScareCrow
November 20, 2021 at 11:26:14 PM UTC - permalink -

- https://adamsvoboda.net/evading-edr-with-scarecrow/

Introducing Process Hiving & RunPE - Nettitude Labs
September 6, 2021 at 9:44:43 AM UTC - permalink -

- https://labs.nettitude.com/blog/introducing-process-hiving-runpe/

Blinding EDR On Windows - Red Team Blog
September 6, 2021 at 9:44:26 AM UTC - permalink -

- https://synzack.github.io/Blinding-EDR-On-Windows/

FireWalker: A New Approach to Generically Bypass User-Space EDR Hooking - MDSec
June 30, 2021 at 12:59:52 PM UTC - permalink -

- https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/

PE Parsing and Defeating AV/EDR API Hooks in C++ - SolomonSklash.io
June 30, 2021 at 12:30:28 PM UTC - permalink -

- https://www.solomonsklash.io/pe-parsing-defeating-hooking.html

Mr-Un1k0d3r/RedTeamCCode: Red Team C code repo
February 17, 2021 at 2:41:30 PM UTC - permalink -

- https://github.com/Mr-Un1k0d3r/RedTeamCCode

A tale of EDR bypass methods | S3cur3Th1sSh1t
February 2, 2021 at 12:58:33 PM UTC - permalink -

- https://s3cur3th1ssh1t.github.io/A-tale-of-EDR-bypass-methods/

Process Herpaderping | herpaderping
October 28, 2020 at 4:10:40 PM UTC - permalink -

- https://jxy-s.github.io/herpaderping/

PowerPoint Presentation - eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf
October 20, 2020 at 9:31:03 AM UTC - permalink -

- https://www.blackhat.com/docs/eu-17/materials/eu-17-Liberman-Lost-In-Transaction-Process-Doppelganging.pdf

Adam Chester on Twitter: "Want to stop ETW from giving up your loaded .NET assemblies to that pesky EDR, but can't be bothered patching memory? Just pass COMPlus_ETWEnabled=0 as an environment variable during your CreateProcess call 😂 https://t.co/wXWeSdt0li" / Twitter
June 5, 2020 at 10:50:03 AM UTC - permalink -

- https://twitter.com/_xpn_/status/1268712093928378368/photo/1