Instagram Linkedin Twitter Youtube
Search
  • Home
  • Pentesting Tools
  • Vulnerability Analysis
  • Information Gathering
  • Web Application Security
  • Forensics
  • Malware
  • OSINT
Instagram Linkedin Twitter Youtube
Kali Linux Tutorials Kali Linux Tutorials
Kali Linux Tutorials Kali Linux Tutorials
Home Kali Linux Invoke-EDRChecker : Checks Running Processes, Process Metadata, Dlls Loaded Into Your Current...
  • Kali Linux

Invoke-EDRChecker : Checks Running Processes, Process Metadata, Dlls Loaded Into Your Current Process

By
R K
-
March 18, 2022
Invoke-EDRChecker : Checks Running Processes, Process Metadata, Dlls Loaded Into Your Current Process

Invoke-EDRChecker is the script will check running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV’s, EDR’s and logging tools.

This script can be loaded into your C2 server as well for example in PoshC2, place the script into your modules directory, load the module then run it. Note: this script is now included in PoshC2 so no need to manually add it.

The script also has capacity to perform checks against remote targets if you have the privileges to do so, these checks are presently limited however to process checking, common install directories and installed services.

I will continue to add and improve the list when time permits. A full roadmap can be found below.

The C# version of this tool is much improved over the PowerShell version and can be found here:

https://github.com/PwnDexter/SharpEDRChecker

Find me on twitter @PwnDexter for any issues or questions!

Install

git clone https://github.com/PwnDexter/Invoke-EDRChecker.git

Usage

Once the script has been loaded into your host or C2 of choice, you can use the following commands:

Run the script against the local host and perform checks based on current user integrity:

Invoke-EDRChecker

Run the script and force registry checks to be performed (for use when you are not running as admin):

Invoke-EDRChecker -Force

To bypass the pre-checks for remote hosts use -Ignore flag to bypass connectivity checks

Invoke-EDRChecker -Remote -Ignore

Example Output – Note: These screenshots need updated and this has only been tested on Windows 10, more testing to come.

If processes and drivers are hidden and still found:

Using EDR-Checker with PoshC2:

Download

Related

  • TAGS
  • DLLs
  • Invoke-EDRChecker
  • Metadata
Facebook
Twitter
Pinterest
WhatsApp
    Previous articleIDACode : An Integration For IDA And VS Code Which Connects Both To Easily Execute And Debug
    Next articleEspionage : A Network Packet And Traffic Interceptor For Linux. Spoof ARP And Wiretap A Network
    R K
    R K

    RELATED ARTICLESMORE FROM AUTHOR

    file command
    Kali Linux

     The file Command – Quickly Identify File Contents in Linux

    touch command
    Kali Linux

    How to Use the touch Command in Linux

    find command
    Kali Linux

    How to Search Files and Folders in Linux Using the find Command

    MCP

    Understanding the Model Context Protocol (MCP) and How It Works

    0xSnow - October 1, 2025 0
    Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open standard that enables AI applications, such as large language models,...
    file command

     The file Command – Quickly Identify File Contents in Linux

    0xSnow - October 1, 2025 0
    While file extensions in Linux are optional and often misleading, the file command helps decode what a file truly is. This powerful utility analyzes the actual...
    touch command

    How to Use the touch Command in Linux

    0xSnow - October 1, 2025 0
    The touch command is one of the quickest ways to create new empty files or update timestamps for existing files in Linux. It’s widely used by...
    find command

    How to Search Files and Folders in Linux Using the find Command

    0xSnow - October 1, 2025 0
    Handling large numbers of files is routine for Linux users, and that’s where the find command shines. It’s a dynamic tool that helps you search for...
    mv command

    How to Move and Rename Files in Linux with the mv Command

    0xSnow - October 1, 2025 0
    Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy to relocate or rename items without hassle. Whether organizing...
    KALI LINUX TUTORIALS
    Contact us: admin@kalilinuxtutorials.com
    Instagram Linkedin Twitter Youtube

    EVEN MORE NEWS

    MCP

    Understanding the Model Context Protocol (MCP) and How It Works

    October 1, 2025
    file command

     The file Command – Quickly Identify File Contents in Linux

    October 1, 2025
    touch command

    How to Use the touch Command in Linux

    October 1, 2025

    POPULAR CATEGORY

    • Kali Linux2943
    • Cyber security912
    • Hacking Tools300
    • Pentesting Tools197
    • Exploitation Tools144
    • TECH135
    • Vulnerability Analysis116
    • Privacy Policy
    • About
    • Contact US
    © Kalilinuxtutorials.com 2025
    MORE STORIES

    WhatsSpy : Trace The Moves Of A WhatsApp User

    May 28, 2019

    IOSSecuritySuite : iOS Platform Security And Anti-Tampering Swift Library

    June 17, 2022

    Whispers : Identify Hardcoded Secrets In Static Structured Text

    December 7, 2021