Block the outbound traffic of running Windows Defender processes using the Windows Filtering Platform APIs.

APC Queue Injection EDR Evasion in Rust

Experimental enduser threat detection system.

A windows 11 rootkit in Rust

Event Tracing for Windows EDR bypass in Rust (usermode)

WhiteBeam: Transparent endpoint security

Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact).

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.