dobin/RedEdr

EDR Lab for Experimentation Purposes

Simulate the behavior of AV/EDR for malware development training.

This project aims to compare and evaluate the telemetry of various EDR products.

Open EDR public repository

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

AV/EDR killer leveraging vulnerable kernel drivers

Rapidly Search and Hunt through Windows Forensic Artefacts