github.com/Xacone/BestEdrOfTheMarket @v1.1.0

�� # <a href="https://xacone.github.io/BestEdrOfTheMarket.html"> Best EDR Of The Market (BEOTM) =�2� </a> <i>Little AV/EDR Evasion Lab for training & learning purposes.</i> (<���� under construction..) <img src="https://github.com/Xacone/BestEdrOfTheMarket/raw/v1.1.0/Assets/beotm_banner.png"> <br>BestEDROfTheMarket is a naive user-mode EDR (Endpoint Detection and Response) project, designed to serve as a testing ground for understanding and bypassing EDR's user-mode detection methods that are frequently used by these security solutions. <br>These techniques are mainly based on a dynamic analysis of the target process state (memory, API calls, etc.), <!-- <a href="https://xacone.github.io/BestEdrOfTheMarket.html"><b>- Introducing the Best EDR Of The Market Project</b></a><br> --> <a href="https://xacone.github.io/BestEdrOfTheMarketV2.html"><b>�'� What's new in Best EDR Of The Market v1.1.0 <���</b></a> ## Defensive Techniques �&� - [x] <a href="#"> NT-Level API Hooking </a> <br> - [x] <a href="#"> Kernel32/Base API Hooking </a> <br> - [x] <a href="#"> Active Response w/ YARA rules or simple patterns </a> <br> - [x] <a href="#"> IAT Hooking </a> <br> - [x] <a href="#"> Threads Call Stack Monitoring (Stacked parameters + Unbacked addresses) </a> <br> - [x] <a href="#"> Heap Regions Analysis </a> <br> - [x] <a href="#"> Direct Syscalls Detection </a> <br> - [x] <a href="#"> Indirect Syscalls Detection </a> <br> - [x] <a href="#"> AMSI/ETW Patching Mitigation </a> <br> - [x] <a href="#"> SSN Hooking/Crushing <i>(fantasy)</i></a> <br> <i>In progress</i>: - [ ] <a href="#"> Proper Threads Creation Monitoring </a> <br> - [ ] <a href="#"> AMSI Scanning </a> <br> <details> <summary><b>List of hooks >؝�</b></summary> <h4>NTDLL hooks (More hooks on road..)</h4> <br> <table style="font-size: 14px;"> <tr> <th>Function</th> <th>Description</th> </tr>" <tr> <td>NtProtectVirtualMemory</td> <td>Change the protection on a region of committed pages in the virtual address space of a process using native API.</td> </tr> <tr> <td>NtWriteVirtualMemory</td> <td>Write data to the memory of a specified process using native API.</td> </tr> <tr> <td>NtMapViewOfSection</td> <td>Create a view of a section of a file mapping into the address space of the calling process using native API.</td> </tr> </table> <h4>Kernel32/Base hooks</h4><br> <table style="font-size: 14px;"> <tr> <th>Function</th> <th>Description</th> </tr> <tr> <td>VirtualAlloc</td> <td>Allocate memory in the virtual address space of a process.</td> </tr> <tr> <td>WriteProcessMemory</td> <td>Write data to the memory of a specified process.</td> </tr> <tr> <td>VirtualFree</td> <td>Release or decommit a region of memory previously allocated.</td> </tr> <tr> <td>VirtualFreeEx</td> <td>Release or decommit a region of memory in a specified process.</td> </tr> <tr> <td>VirtualProtect</td> <td>Change the protection on a region of committed pages in the virtual address space of a process.</td> </tr> <tr> <td>MapViewOfFile</td> <td>Create a view of a file mapping into the address space of the calling process.</td> </tr> <tr> <td>VirtualProtectEx</td> <td>Change the protection on a region of committed pages in the virtual address space of a specified process.</td> </tr> <tr> <td>UnmapViewOfFile</td> <td>Unmap a mapped view of a file from the calling process's address space.</td> </tr> <tr> <td>VirtualQuery</td> <td>Retrieve information about a range of pages in the virtual address space of a specified process.</td> </tr> <tr> <td>ReadProcessMemory</td> <td>Read data from the memory of a specified process.</td> </tr> <tr> <td>InternetOpenUrlW</td> <td>Opens a URL for reading on the internet.</td> </tr> <tr> <td>InternetReadFile</td> <td>Reads data from a handle opened by the InternetOpenUrl or InternetOpenUrlW function.</td> </tr> <tr> <td>InternetReadFileExW</td> <td>Reads data from a handle opened by the InternetOpenUrl or InternetOpenUrlW function, and can also return additional data.</td> </tr> <tr> <td>InternetOpenW</td> <td>Initializes an application's use of the WinINet functions.</td> </tr> </table> <h4>Import Address Table (IAT) Hooks</h4><br> <table style="font-size: 14px;"> <tr> <th>Function Name</th> <th>Purpose</th> </tr> <tr> <td>WriteProcessMemory</td> <td>Writes data to an area of memory in a specified process</td> </tr> <tr> <td>ReadProcessMemory</td> <td>Reads data from an area of memory in a specified process</td> </tr>