# antivirus

Published articles for antivirus.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls

DevFeed: [EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-2-32630.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/06/14/lets-create-an-edr-and-bypass-it-part-2/>)

Author: CCob

Published: 2020-06-14T10:47:09Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Code](<https://devfeed.tech/topics/code.md>), [API](<https://devfeed.tech/topics/api.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [boilerplate](<https://devfeed.tech/tags/boilerplate.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [code](<https://devfeed.tech/tags/code.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [process](<https://devfeed.tech/tags/process.md>), [sharpblock](<https://devfeed.tech/tags/sharpblock.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>)

### AI overview

This tutorial examines methods for bypassing an active-protection EDR, including avoiding suspicious RWX memory changes, unhooking API calls, and using direct syscall instructions. It also introduces SharpBlock and accompanying code.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part 2 I introduce SharpBlock, a method of bypassing EDR's. The post Lets Create An EDR... And Bypass It! Part 2 appeared first on Ethical Chaos.

## Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)

DevFeed: [Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-1-32629.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/05/27/lets-create-an-edr-and-bypass-it-part-1/>)

Author: CCob

Published: 2020-05-27T18:50:50Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Part one explains how a basic EDR detects malicious files and behavior through signature detection, kernel-level file system filters, sandboxing, and dynamic analysis. It also introduces sandbox bypass concepts involving analysis time limits and disrupted control flow.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part one we cover how to create a basic EDR. The post Lets Create An EDR... And Bypass It! Part 1 appeared first on Ethical Chaos.

## How to Create a Malware Detection System With Machine Learning

DevFeed: [How to Create a Malware Detection System With Machine Learning](<https://devfeed.tech/articles/how-to-create-a-malware-detection-system-with-machine-learning-41262.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2019/05/22/How-to-create-a-Malware-detection-system-with-Machine-Learning/>)

Author: Simone Margaritelli

Published: 2019-05-22T21:59:13Z

Content type: tutorial

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Machine Learning & Artificial Intelligence](<https://devfeed.tech/topics/machine-learning-artificial-intelligence.md>), [Neural Network](<https://devfeed.tech/topics/neural-network.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [antivirus](<https://devfeed.tech/tags/antivirus.md>), [binary-analysis](<https://devfeed.tech/tags/binary-analysis.md>), [classification](<https://devfeed.tech/tags/classification.md>), [computer-virus](<https://devfeed.tech/tags/computer-virus.md>), [cuda](<https://devfeed.tech/tags/cuda.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [deep-learning](<https://devfeed.tech/tags/deep-learning.md>), [deep-neural-networks](<https://devfeed.tech/tags/deep-neural-networks.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [dnn](<https://devfeed.tech/tags/dnn.md>), [ergo](<https://devfeed.tech/tags/ergo.md>), [feature-engineering](<https://devfeed.tech/tags/feature-engineering.md>), [features](<https://devfeed.tech/tags/features.md>), [gpu](<https://devfeed.tech/tags/gpu.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [keras](<https://devfeed.tech/tags/keras.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-detection](<https://devfeed.tech/tags/malware-detection.md>), [neural-network](<https://devfeed.tech/tags/neural-network.md>), [neural-networks](<https://devfeed.tech/tags/neural-networks.md>), [nvidia](<https://devfeed.tech/tags/nvidia.md>), [portable-executable](<https://devfeed.tech/tags/portable-executable.md>), [security-research](<https://devfeed.tech/tags/security-research.md>), [tensorflow](<https://devfeed.tech/tags/tensorflow.md>), [tf](<https://devfeed.tech/tags/tf.md>), [windows-pe](<https://devfeed.tech/tags/windows-pe.md>)

### AI overview

A practical tutorial on using machine learning and artificial neural networks to detect Windows malware without relying on an explicit signatures database. It uses malware detection as an example for the ergo project, which automates parts of model creation, data encoding, GPU training, benchmarking, and deployment.

### Source excerpt

In this post we'll talk about two topics I love and that have been central elements of my (private) research for the last ~7 years: machi