ZeroMemoryEx/Blackout

AV/EDR killer leveraging vulnerable kernel drivers

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

An even funnier way to disable windows defender (through WSC api)

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

A slightly more fun way to disable windows defender + firewall. (through the WSC api)

This map lists the essential techniques to bypass anti-virus and EDR

Multilayered AV/EDR Evasion Framework (no longer actively maintained)

Simulate the behavior of AV/EDR for malware development training.