reveng007/DarkWidow

Simulate the behavior of AV/EDR for malware development training.

A memory-based evasion technique which makes shellcode invisible from process start to end.

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

Endpoint and Lateral Movement Evasion

Multilayered AV/EDR Evasion Framework (no longer actively maintained)

AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64

This is for Ethical Use only. The default automated binaries created are all burned. I have added the script to the repo to modify certain signatures and it will still work.

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

EDR Lab for Experimentation Purposes