EDR Lab for Experimentation Purposes
-
Updated
Jun 10, 2026 - C++
#
defense-evasion
Here are 25 public repositories matching this topic...
-
Updated
Aug 20, 2026 - C++
This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found within the library
incident-response offensive-security impacket malware-detection indicators-of-compromise detection-engineering defense-evasion
-
Updated
Sep 7, 2026
yep full list of virustotal machines, OG REPO
python list protection blacklist virus antivirus evasion bypass virustotal defense-evasion vt-blacklist anti-virustotal
-
Updated
Nov 8, 2025 - Python
A collection of Cobalt Strike Aggressor scripts.
-
Updated
Jan 3, 2022 - PowerShell
A curated list of tools useful within the field of cyber security, for both blue and red team operations.
awesome osint reverse-engineering hacking deobfuscation cybersecurity awesome-list post-exploitation malware-analysis blueteam c2 social-engineering reconnaissance command-and-control reverse-enginnering redteam defense-evasion initial-access
-
Updated
Dec 20, 2024
ExecEvasion is a lightweight execution-evasion toolkit that generates command variants designed to bypass naive filters and WAF rules by leveraging real shell parsing behavior on Linux and Windows.
-
Updated
Jan 31, 2026 - HTML
Red Team Operation's Defense Evasion Technique.
cybersecurity redteaming redteam clanguage redteam-tools defense-evasion redteam-articles processhollowing
-
Updated
Jun 4, 2024 - C
Pure-Go offensive-security primitives library: syscalls, evasion (AMSI/ETW/unhook/sleepmask), injection, PE packer, credentials, post-ex, C2. MITRE ATT&CK mapped. Authorized research only.
golang packer persistence shellcode syscalls pentest offensive-security malware-development red-team bof mitre-attack process-injection windows-security defense-evasion unhooking edr-bypass byovd c2-framework sleep-obfuscation lsass-dump
-
Updated
Jul 13, 2026 - Go
PadZip Evader - Binary padding and ZIP compression tool for educational anti-analysis research. Inflates executables and creates highly compressed archives to demonstrate AV/EDR evasion techniques.
-
Updated
Oct 3, 2025 - Python
A stealthy Payload (and/or DLL) injector for Windows 10/11, capable of injecting a msfvenom payload (or specified DLL) into a suspended process and evade detection
python c asm obfuscator dll-injection windows10 evasion msfvenom payload msfvenom-payload dll-injector payload-injector defense-evasion windows11 edr-evasion suspend-process
-
Updated
Jun 24, 2026 - C
PoC implementation of the GhostWriting injection technique for x64 Windows
windows x86-64 injection poc pentesting windows-x64 redteam ghostwriting process-injection shellcode-injection shellcode-execute defense-evasion wpm-less-wpm popcalc
-
Updated
Feb 18, 2025 - C
Beacon Object File PoC implementation of KillDefender
beacon cobalt-strike av-evasion redteaming bof redteam aggressor-script cobaltstrike-cna cobaltstrike defense-evasion aggressorscript evade-av av-evade
-
Updated
Feb 9, 2022 - C
A high-performance stealth Reflective PE-Loader for Windows binaries. Protections, Encrypts, Compresses, and executes EXE and DLL payloads directly from RAM with zero disk footprint.
python c windows builder packer x86-64 reverse-engineering loader low-level win32 system-programming pe-format pe-loader red-team binary-protection anti-analysis manual-mapping in-memory-execution defense-evasion reflective-loader
-
Updated
Sep 12, 2026 - C
Complete forensic analysis of a zero-detection infostealer hidden in a pirated Adobe Illustrator 2026 installer (Set-up.exe). Includes full IOCs, MITRE ATT&CK mapping, sandbox behavior, C2 infrastructure, and incident response guidance. Defensive security research only.
ioc dotnet incident-response reverse-engineering malware forensics dfir trojan cybersecurity threat-hunting malware-analysis malware-research yara virustotal threat-intelligence mitre-attack windows-malware defense-evasion infostealer sandbox-analysis
-
Updated
May 12, 2026
MITRE ATT&CK Submission - Changing Module names at runtime
malware malware-research process-manipulation security-research mitre-attack defense-evasion windows-process
-
Updated
May 27, 2024 - C++
Builder for analysis-aware Windows droppers
python cpp dropper malware-development anti-debugging anti-analysis anti-sandbox anti-vm security-research windows-malware defense-evasion detection-evasion
-
Updated
Jun 17, 2025 - Python
Download Adobe Illustrator for Windows 10 and 11 using this direct installer.
graphics typography illustration cybersecurity hot branding logo-design hot-patch print-design typography-tools creative-tools defense-evasion illustrator-2026 logo-design-ai hot-door-cadtools-software hot-trial hot-software
-
Updated
Sep 25, 2026
A Cobalt Strike shellcode loader that bypasses mainstream domestic antivirus software.
aes-encryption dotnet-framework privilege-escalation cobalt-strike memory-injection threat-intelligence process-hollowing exploit-development mitre-attack malleable-c2 cobaltstrike process-injection csharp-loader windows-malware shellcode-injection defense-evasion edr-evasion c2-framework beacon-loader stageless-beacon
-
Updated
Sep 25, 2026 - C#
Evasion and payload crafting framework — AMSI bypass, AV evasion encoding, process injection, LOLBaS, shellcode staging, and EDR fingerprinting.
python security cybersecurity penetration-testing shellcode evasion offensive-security red-team edr process-injection amsi-bypass defense-evasion
-
Updated
Jul 11, 2026 - Python
Add this topic to your repo
To associate your repository with the defense-evasion topic, visit your repo's landing page and select "manage topics."