DefenseEvasionTechniques - This comprehensive and central repository is desig

项目说明

<html>
<body>
<di=center>
<img src="Assets/MD.jpg" alt="MYSETUP" width="450" height="450">
</div>
<h1 align=center>Defense E Techniques</h1>
<p>This collection offers ad methods to bypass sophisticated security measures in Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) systems. This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead in the field. It provides a resource for those dedicated to improving their skills, security defenses and measures. This repository includes strategies for manipulating system calls, obfuscating code, managing memory to evade detection and other ad e techniques. By le these methods, experts can enhance penetration testing, red teaming, malware analysis, and develop more resilient defenses.</p>
<h2>Open Source Work</h2>
<table class="blogs-table" style="width: 100%; border-collapse: collapse;">
<tr style="background-color: #f2f2f2;">
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Blog Detail</a>
</th>
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Blog Link</a>
</th>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Shadows of LSASS Dumping: E Techniques and the Ongoing Struggle of EDR Solutions to Defend a Prime Attacker Target</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">BYOVD A Kernel Attack: Stealthy Threat to Endpoint Security</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Arsenal 2.0: Ele Malware Stealth Tactics to bypass static detection</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">PEB Walk: Avoid API function calls inspection in IAT by analyst and also bypass static detection of AV/EDR</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Arsenal: Bypass EDR’s/XDR’s and make malware analysis harder</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">On-Disk Detection: Bypass AV’s/EDR’s using syscalls with legacy instruction, series of instructions and random nop instructions</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">EASE POST-EXPLOITATION: Getting elevated reverse shell using DLL Hijacking and Mock Directories</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">AV/EDR E Using Direct System Calls (User-Mode )</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Bypass “Mimikatz” using the Process Injection Technique</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
</table>

<h2>Top Posts</h2>
<table class="my-posts" style="width: 100%; border-collapse: collapse;">
<tr style="background-color: #f2f2f2;">
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Detail</a>
</th>
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</th>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Dirty implementaion using direct syscalls</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Mokingjay Technique Implementaion to avoid RWX region detection</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Combining Unhooking and ETW patching to dump lsass.exe memory</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Direct syscalls to dump lsass.exe memory and offline dumping</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Remote Template Injection</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Mark-of-the-Web for Red Team</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Memory dump using outflank dumpert and Windows process injection</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Nt-Authority Shell using Fodhelper</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">RWX-Memory hunt and injection with CreateRemoteThread</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">EDR Terminator (call it killer)</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Lsass.exe memory dumping using multiple techniques [𝐋𝐚𝐠𝐨𝐬 𝐈𝐬𝐥𝐚𝐧𝐝 𝐌𝐞𝐭𝐡𝐨𝐝 (𝐚.𝐤.𝐚 𝐑𝐞𝐟𝐥𝐞𝐜𝐭𝐢𝐯𝐞𝐋𝐨𝐚𝐝𝐢𝐧𝐠), 𝐖𝐢𝐧𝐝𝐨𝐰𝐬 𝐏𝐫𝐨𝐜𝐞𝐬𝐬 𝐈𝐧𝐣𝐞𝐜𝐭𝐢𝐨𝐧: 𝐂𝐨𝐧𝐬𝐨𝐥𝐞𝐖𝐢𝐧𝐝𝐨𝐰𝐂𝐥𝐚𝐬𝐬, 𝐖𝐢𝐧𝐝𝐨𝐰𝐬 𝐅𝐨𝐫𝐤𝐢𝐧𝐠]</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">UAC Bypass Using .NET profiler DLL Loading </td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Remove EDR callbacks using driver</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Pri Escalation using Driver</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">Post Link</a>
</td>
</tr>
</table>
<h2>Github Repo</h2>
<table class="my-code" style="width: 100%; border-collapse: collapse;">
<tr style="background-color: #f2f2f2;">
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Project</a>
</th>
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Link</a>
</th>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">"D3MPSEC" lsass.exe memory dumping.</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Combination of multiple e techniques to evade defenses (Dirty ).</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Deploy Honeypots and Decoys to Gather Threat Intelligence</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Persistence and Anti-Sandox Techniques</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Bypass Malware Static Analysis</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Get elevated shell on C2 server with DLL Hijacking</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Rwx Hunting and Injection using Fork API</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">WriteProcessMemory Magic and Injection (Address of Entry Point)</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">PEB Walk and API Obfuscation to bypass AV/EDR static analysis</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">.NET Profiler DLL Loading UAC Bypass</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">BYOVD to escalate pri to SYSTEM</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">
<a href=" style="text-decoration: underline; color: inherit; font-weight: bold;">
</td>
</tr>
</table>
<h2>E Techniques</h2>
<table style="width: 100%; border-collapse: collapse;">
<tr style="background-color: #f2f2f2;">
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Technique</a>
</th>
<th style="border: 1px solid black; padding: 8px; text-align: left;">
<a href="#" style="text-decoration: underline; color: inherit; font-weight: bold;">Description</a>
</th>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Direct and Indirect Syscalls</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Strategies for making direct and indirect function calls to evade detection mechanisms.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">API Hashing</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Techniques for obfuscating and altering API calls to avoid detection.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">API Imports Obfuscation</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Methods to obfuscate code and make it harder to analyze.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Payload Encryption</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Use of encryption to bypass static analysis of EDRs.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Egg Hunting</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Syscall Instruction In-memory patching to bypass static detection.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Random Instructions and Prototypes</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Use random NOP instructions and name of API, prototypes to avoid static analysis.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Mokingjay</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Use of dll to avoid detection of RWX memory region creation.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Forking Technique Memory Dumps</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Use of windows fork API to clone parent process after injecting shellcode, avoid detection of CreateRemoteThread.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">API Unhooking</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Unhooking EDRs user mode hooks using clean copy of dll, raw copy from remote server, suspended process to bypass EDRs.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">ETW Patching</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Applying ETW patching to avoid event based detection.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">PEB Lookup</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Resolving SSN and Native API's on run-time using PEB lookup for 32bits & 64bits.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">RWX Memory Block Hunt</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Hunt for already created RWX region to write and execute shellcode. This technique remove the dependencies of DLL with RWX and API to allocate RWX.</td>
</tr>
<tr>
<td style="border: 1px solid black; padding: 8px; text-align: left;">BYOVD</td>
<td style="border: 1px solid black; padding: 8px; text-align: left;">Bring your own dri in deploying drivers that are legitimately signed and can be successfully loaded into Windows systems to execute code in kernel context.</td>
</tr>
</table>
<br>

<di="disclaimer">
<h2>Disclaimer</h2>
<p>The content, techniques, and tools provided in this repository are intended solely for educational and research purposes within the cybersecurity community. I explicitly disclaim any responsibility for the misuse or unlawful use of the provided materials. Any actions taken based on the information are done so at the user's own risk.</p>
</div>
</body>
</html>

Demo

--------------------------------------------------

### Contact
For any inquiries or contributions, feel free to reach out to the ME.

项目信息

开发语言：C++

Star 数：166

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead in the field. It provides a valuable resource for those dedicated to improving their skills in malware development, malware research, offensive security, security defenses and measures.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。