# EDR

Published articles for EDR.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## In-Process Patchless AMSI Bypass

DevFeed: [In-Process Patchless AMSI Bypass](<https://devfeed.tech/articles/in-process-patchless-amsi-bypass-32633.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2022/04/17/in-process-patchless-amsi-bypass/>)

Author: CCob

Published: 2022-04-17T16:30:25Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Windows](<https://devfeed.tech/topics/windows.md>), [Exception](<https://devfeed.tech/topics/exception.md>), [exceptions](<https://devfeed.tech/topics/exceptions.md>), [debug](<https://devfeed.tech/topics/debug.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [breakpoint](<https://devfeed.tech/tags/breakpoint.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [c2](<https://devfeed.tech/tags/c2.md>), [context](<https://devfeed.tech/tags/context.md>), [debugger](<https://devfeed.tech/tags/debugger.md>), [edr](<https://devfeed.tech/tags/edr.md>), [exception](<https://devfeed.tech/tags/exception.md>), [exception-handling](<https://devfeed.tech/tags/exception-handling.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extension](<https://devfeed.tech/tags/extension.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains an in-process, patchless AMSI bypass approach using vectored exception handling. It contrasts this technique with SharpBlock's debugger-based child-process method and describes manipulating thread context at the point an exception occurs.

### Source excerpt

Some of you may remember my patchless AMSI bypass article and how it was used inside SharpBlock to bypass AMSI on the child process that SharpBlock spawns. This is all well a good when up against client environments that are not too sensitive to the fork and run post exploitation model of operating. What about [...] The post In-Process Patchless AMSI Bypass appeared first on Ethical Chaos.

## EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls

DevFeed: [EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-2-32630.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/06/14/lets-create-an-edr-and-bypass-it-part-2/>)

Author: CCob

Published: 2020-06-14T10:47:09Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Code](<https://devfeed.tech/topics/code.md>), [API](<https://devfeed.tech/topics/api.md>), [Processes](<https://devfeed.tech/topics/processes.md>)

Tags: [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [boilerplate](<https://devfeed.tech/tags/boilerplate.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [code](<https://devfeed.tech/tags/code.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [process](<https://devfeed.tech/tags/process.md>), [sharpblock](<https://devfeed.tech/tags/sharpblock.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>)

### AI overview

This tutorial examines methods for bypassing an active-protection EDR, including avoiding suspicious RWX memory changes, unhooking API calls, and using direct syscall instructions. It also introduces SharpBlock and accompanying code.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part 2 I introduce SharpBlock, a method of bypassing EDR's. The post Lets Create An EDR... And Bypass It! Part 2 appeared first on Ethical Chaos.

## Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)

DevFeed: [Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-1-32629.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/05/27/lets-create-an-edr-and-bypass-it-part-1/>)

Author: CCob

Published: 2020-05-27T18:50:50Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Part one explains how a basic EDR detects malicious files and behavior through signature detection, kernel-level file system filters, sandboxing, and dynamic analysis. It also introduces sandbox bypass concepts involving analysis time limits and disrupted control flow.

### Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part one we cover how to create a basic EDR. The post Lets Create An EDR... And Bypass It! Part 1 appeared first on Ethical Chaos.

## Weaponizing your favorite Go program for Cobalt Strike

DevFeed: [Weaponizing your favorite Go program for Cobalt Strike](<https://devfeed.tech/articles/weaponizing-your-favorite-go-program-for-cobalt-strike-32625.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/01/26/weaponizing-your-favorite-go-program-for-cobalt-strike/>)

Author: CCob

Published: 2020-01-26T17:40:54Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Go Language](<https://devfeed.tech/topics/go-language.md>), [CMake](<https://devfeed.tech/topics/cmake.md>), [gcc](<https://devfeed.tech/topics/gcc.md>), [Compiler](<https://devfeed.tech/topics/compiler.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [bypass](<https://devfeed.tech/tags/bypass.md>), [cmake](<https://devfeed.tech/tags/cmake.md>), [cobalt-strike](<https://devfeed.tech/tags/cobalt-strike.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [edr](<https://devfeed.tech/tags/edr.md>), [gcc](<https://devfeed.tech/tags/gcc.md>), [github](<https://devfeed.tech/tags/github.md>), [go](<https://devfeed.tech/tags/go.md>), [golang](<https://devfeed.tech/tags/golang.md>), [reflective-dll](<https://devfeed.tech/tags/reflective-dll.md>), [weaponize](<https://devfeed.tech/tags/weaponize.md>), [weaponizing](<https://devfeed.tech/tags/weaponizing.md>)

### AI overview

This tutorial explains how to adapt a Go program into a reflective DLL for in-memory execution within Cobalt Strike. It presents a GitHub template based on gobuster and describes its use of CMake, GCC, the Go compiler, and CGO.

### Source excerpt

How to convert a Go program to a reflective DLL for Cobalt Strike The post Weaponizing your favorite Go program for Cobalt Strike appeared first on Ethical Chaos.