edr-evasion topic

This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections.

VirtualAlllocEx

Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged

VirtualAlllocEx

Unhook DLL via cleaning the DLL 's .text section

Kara-4search

.NET/PowerShell/VBA Offensive Security Obfuscator

Accenture

Call stack spoofing for Rust

Kudaes

Go shellcode loader that combines multiple evasion techniques

f1zm0

indirect syscalls for AV/EDR evasion in Go assembly

f1zm0

Nim process hollowing loader

itaymigdal

Threadless Process Injection through entry point hijacking

Kudaes