PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

Windows user-land hooks manipulation tool.

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object Callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

Transparently call NTAPI via Halo's Gate with indirect syscalls.

PoC LKM to force run cleanup_module() on other LKMs

Kernel-based Process Monitoring on Linux Endpoints for File System, TCP and UDP Networking Events and optionally DNS, HTTP and SYSLOG Application Messages via eBPF Subsystem

WFP Endpoint Protection Traffic Blocker

eBPF-based runtime agent for Endpoint Detection and Response for Linux based operating systems.

A tool to detect in-memory EDR hooks on ARM64 Linux by comparing in-memory libc function bytes with the clean on-disk bytes and applying ARM64-specific heuristics.