WFP Endpoint Protection Traffic Blocker

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

A tool to detect in-memory EDR hooks on ARM64 Linux by comparing in-memory libc function bytes with the clean on-disk bytes and applying ARM64-specific heuristics.

eBPF-based runtime agent for Endpoint Detection and Response for Linux based operating systems.

PoC LKM to force run cleanup_module() on other LKMs

Transparently call NTAPI via Halo's Gate with indirect syscalls.

Kernel-based Process Monitoring on Linux Endpoints for File System, TCP and UDP Networking Events and optionally DNS, HTTP and SYSLOG Application Messages via eBPF Subsystem

Windows user-land hooks manipulation tool.

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes