Poly0n/WinGuard

Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.

EDR Lab for Experimentation Purposes

Open Source EDR framework with functional triage and hot load. Designed for realtime detection of RATs and info stealers

Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatically reduce the false positive rate and hunt for malicious behaviour.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Deep insights into EDR detection approaches

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

Simulate the behavior of AV/EDR for malware development training.