BestEDROfTheMarket is a naive user-mode EDR (Endpoint Detection and Response) project, designed to serve as a testing ground for understanding and bypassing EDR’s user-mode detection methods that are frequently used by these security solutions.
These techniques are mainly based on a dynamic analysis of the target process state (memory, API calls, etc.),
Usage: BestEdrOfTheMarket.exe [args]
/help Shows this help message and quit
/v Verbosity
/iat IAT hooking
/stack Threads call stack monitoring
/nt Inline Nt-level hooking
/k32 Inline Kernel32/Kernelbase hooking
/ssn SSN crushing
BestEdrOfTheMarket.exe /stack /v /k32
BestEdrOfTheMarket.exe /stack /nt
BestEdrOfTheMarket.exe /iat
???? BestEdrOfTheMarket/
???? BestEdrOfTheMarket.exe
???? DLLs/
???? Kernel32.dll
???? ntdll.dll
???? iat.dll
???? TrigerringFunctions.json
???? YaroRules.json
???? jsoncpp.dll
TrigerringFunctions.json: Describes the functions that are already hooked or/and to hook:
ℹ️ Note on call stack monitoring: Some NT routines are more appropriate and less exposed to false positives, for instance, it is strongly recommended to monitor the NtCreateFile
when targeting an encrypted shellcode loader, but you should avoid it when targeting a reflective loader in favor of NtCreateUserProcess
, which is better suited.
{
"DLLBasedHooking": {
"NTDLL.dll": [
"NtAllocateVirtualMemory",
"..."
],
"KERNELBASE.dll": [
"VirtualAlloc"
"..."
],
"KERNEL32.dll": [
"VirtualAlloc"
"..."
]
},
"StackBasedHooking": {
"Functions": [
"NtCreateUserProcess",
"..."
]
},
"SSNCrushingRoutines": {
"Functions": [
"NtCreateSection"
"..."
]
},
"IATHooking": {
"Functions": [
"VirtualAlloc",
"..."
]
}
}
If you don’t compile your own DLLs, take a look at the functions already hooked into the DLLs provided in sources.
OSINT tool to scrape names and usernames from large friend lists on Facebook, without being…
Telepathy has been described as the "swiss army knife of Telegram tools," allowing OSINT analysts,…
Blackbird is a robust OSINT tool that facilitates rapid searches for user accounts by username…
This is example of scraping public LegiFrance registry's naturalisation decrees for research purposes only (naturalisation…
Sabonis provides a way of quickly parsing EVTX, proxy and PCAP files and extracting just…
AutoExif is a powerful Bash script designed to streamline the process of editing image metadata…