AV-EDR-Lab-Environment-Setup - AV/EDR Lab environment setup references to help in

项目说明

AV/EDR Lab En Setup

> Initially taken from Malde Discord and added more resources.

> Notion Notes :

An example of things that can be used to emulate certain features that paid edrs have:

- SACL - sysmon
-
-
- Sysmon Config :
- HOOKS
- bitdefender free : hooking.html
- HookDetector (Detect all hooked APIs) :
- TelemetrySourcerer (enumerate and disable common sources of telemetry used by AV/EDR, Including ETW , User-ModeHooks, Kernel Callbacks) :
- Detecting manual syscalls from usermode
-
- hook the current process to identify the manual syscall executions on windows :
- Hunt-Weird-Syscalls :
- PROCESS/PESCAN
- Yapscan - hoard as many yara rules as you can
- DetectItEasy(DIE) :
- AMSI Provider
- AMSI Provider :

- ETW-TI/ETW Pro/Consumers -
- silketw :
- ETWInspector :
- List ETW Pro for a process :
- KrabsETW (Microsoft ETW Consumer) :
- BlueKrabsETW (For blueTeams, Based on KrabsETW by microsoft) :
- SealighterTI (Threat-Intelligence ETW Provider) :
- TiEtwAgent (Detect Memory injection based on ETW-TI) :
- PyWinTrace (ETW python Library) :
- EtwExplorer (View ETW Pro Manifest) :
- TelemetrySourcerer (enumerate and disable common sources of telemetry used by AV/EDR, Including ETW , User-ModeHooks, Kernel Callbacks) :
- MentalTi (ETWTi Parser) :
- PockETWatcher :
- ETW Resources
- Contains resources to learn and understand EVTX/ETW (Event Tracing for Windows) :
- KERNEL CALLBACKS -
- Elastic
- Sysmon
- TelemetrySourcerer (enumerate and disable common sources of telemetry used by AV/EDR, Including ETW , User-ModeHooks, Kernel Callbacks) :
- Capa - Capabilities Scanning
- Trace API calls - TinyTracer
-

Collect Windows Telemetry for Maldev

- Collects telemetry like , ETW, ETW-TI, Kernel Callbacks, Hooks, Callstacks, Loaded DLLs, PEB) : , RedEDR UI () (Check other projects by author)

Free Trials EDR/A

- Microsoft Defender For Endpoint
-
-
- Sophos XDR (trial)
- Elastic EDR
-
- EDR.html
-
-
- TrendMicro
- McAfee M
- Avast
- openEDR - Comodo Free EDR
- Wazuh :
- Huntress Managed EDR - (15 Days Free trial , No Credit card Required, 3 High/Critical incident reports by realtime SOC analysts) :

Open Source EDRs

- RedEDR :
- SimpleEDR - Manual DLL Hooking to find Detection Opportunity :
- CrimsonEDR :
- OpenEDR :
- InjDrv :
- MyDumbEDR :
- BestEDROfTheMarket :
- JonMon :
- SylantStrike :
- Whids :
- Write your own EDR
-
-
-

Open Source EDRs Comparison by

!Open-Source-EDR-Comparison.png

Image Load Events Scanners

- Hunt-Weird-ImageLoads :

Process Memory Scanners

- PE-sieve :
- Moneta :
- YapScan :
- MalMemDetect :
- Patriot :
- Hunt-Sleeping-Beacons :
- YaraMemoryScanner :
- Cobalt Strike Beacon Detection Specific Scanners
- BeaconEye :
- BeaconHunter :
- EtwTi-FluctuationMonitor - Doing (RWX) changes CFG bitmap accordingly and then after (RW) CFG stays the same :
-
-
- TiEtwAgent (Detect Memory injection based on ETW-TI) :

Signature Detection Bypass

- ThreatCheck :
- AvRed :

Malware De Machine Setup

Avoid using windows if you are worried about windows telemetry while writing your malware.

Tiny11Builder (To remove many windows unnecessary components including telemetry) (Taken from here) :

AV/EDR Internals/ Telemetry/Benchmarking/Working

EDR Internals

- Matt Hand - E EDR book
- How EDR Works (The Anti-EDR Compedium) :

EDR Internals / Working Talks

-
-
-
-

EDR Telemetry - EDR Telemetry :

-
- EDR Telemetry Spreadsheet :

Defender Har :

EDR Hooks Lists :

- HookDetector (Detect all hooked APIs) :

Polonium : A tool from Modern Initial Access and E Tactics course by Binary-Offensive ().

EDR Hooks Telemetry

<img src=" alt="EDR-Hooks-Telemetry" width="500"/>

- Taken from :

Gartner’s Magic Quadrant for EDR Platforms

<img src=" alt="Gartner's-Magic-Quadrant" width="500"/>

- Taken From :

Credits

Thanks to Malde Discord Members for initial List

Thanks to , For Pro a list of additional resources and open Source EDR Comparison table.

Thanks to , For sharing about huntress Managed EDR Trial offer.

项目信息

开发语言：未知

Star 数：472

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AV/EDR Lab environment setup references to help in Malware development展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。