🛡️ EDR-Bypass-Demos: Fundamental Evasion Techniques

A Practical Code Repository for Red Team Development and AV/EDR Evasion Basics

---

🧠 Conceptual Overview

Welcome to my repository! This project contains the sample code corresponding to my article series, "Red Team Development Basics - Basic Evasion" (by 7bits). I created these demonstrations to provide clear, practical examples of how various evasion techniques operate under the hood. From basic shellcode encryption to advanced system call implementation, this repository serves as a foundational learning tool for understanding how modern defensive mechanisms are bypassed.

---

🚀 Demonstration Breakdown

🧪 Demos 1-3: Foundational Evasion (Part I)

• Demo 1: A C++ implementation that utilizes ETW disabling (disableETW), shellcode encryption, and import table hiding to achieve basic payload evasion.
• Demo 2: A C# implementation leveraging string encryption, XOR payload encryption, and sandbox bypass techniques to evade standard Antivirus solutions.
• Demo 3: An optimized C# approach that improves upon Demo 2's shellcode loading mechanism. I modified SharpInjector to utilize EtwpCreateEtwThread for stealthy shellcode execution.

🧪 Demos 4-5: System Calls (Part II)

• Demo 4: A C++ codebase demonstrating the absolute simplest example of implementing direct system calls (syscalls).
• Demo 5: A C++ implementation utilizing the SysWhispers3 jump method to effectively bypass static analysis checks on system calls.

🧪 Demo 6: Unhooking (Part III)

• Demo 6: A C++ example where I modified the RefleXXion library to perform dynamic unhooking of user32.dll in memory.

---

📊 Advanced Evasion Demos (Part IV)

Note: The following examples focus strictly on endpoint evasion; network traffic characteristics are ignored for these tests.

Demo 1: Basic Obfuscation

Utilizes Base64 + XOR obfuscation for the shellcode. This effectively bypasses standard consumer-grade Antivirus engines.

Demo 2: Enhanced Static Obfuscation

Strengthened static obfuscation routines to bypass built-in OS defenses and traditional enterprise AV solutions.

Demo 3: Syscalls & APC Injection

Incorporates direct syscalls and Asynchronous Procedure Call (APC) execution methods to bypass advanced Endpoint Detection and Response (EDR) agents.

Demo 4: In-Memory Beacon Encryption

Integrates memory encryption techniques for the beacon payload, successfully evading strict heuristic and behavioral EDR engines.

---

🧰 Repository Structure & Languages

EDR-Bypass-demo/
├── chapter4-demo1/      # Chapter 4 Demo 1
├── chapter4-demo2/      # Chapter 4 Demo 2
├── chapter4-demo3/      # Chapter 4 Demo 3
├── chapter4-demo4/      # Chapter 4 Demo 4
├── demo1/               # Demo 1: C++ shellcode loader
├── demo2/               # Demo 2: C# shellcode loader
├── demo3/               # Demo 3: C# EtwpCreateEtwThread
├── demo4/syscall/       # Demo 4: Basic syscall example
├── demo5/syscall3/      # Demo 5: SysWhispers3 jump method
├── demo6/               # Demo 6: user32.dll unhooking
├── images/              # Screenshots and images
└── README.md

Language Distribution

• 🟢 C: 38.9%
• 🔵 C++: 32.2%
• 🟣 C#: 20.8%
• 🟡 Assembly: 8.0%
• ⚪ Python: 0.1%

---

⚖️ License & Legal

🚨 Disclaimer

This repository is provided strictly for educational purposes and authorized penetration testing.
The developer assumes no liability for the misuse of these code snippets. The evasion techniques demonstrated here are meant to help Blue Teams and Security Researchers understand offensive methodologies to build better behavioral detections. Do not deploy these payloads in environments without explicit, written permission.

---

🔗 SEO Keywords (Naturally Integrated)

• C++ shellcode loader techniques
• ETW patching and disabling
• SysWhispers3 syscall implementation
• Asynchronous Procedure Call (APC) injection
• In-memory beacon encryption
• Red Team evasion development
• Dynamic unhooking of user32.dll

---

🔄 Download & Contribution

Contribution Guidelines:

1. Fork this repository to test the evasion demos locally.
2. Ensure all tests are conducted in isolated sandbox environments.
3. Submit PRs for optimizations in code obfuscation or syscall generation.

---