MaorSabag/TrueSightKiller

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

kill anti-malware protected processes ( BYOVD )

An even funnier way to disable windows defender (through WSC api)

Simulate the behavior of AV/EDR for malware development training.

Multilayered AV/EDR Evasion Framework (no longer actively maintained)

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

EDR Lab for Experimentation Purposes

This map lists the essential techniques to bypass anti-virus and EDR

This is for Ethical Use only. The default automated binaries created are all burned. I have added the script to the repo to modify certain signatures and it will still work.