CrimsonEDR - Simulate The Behavior Of AV/EDR For Malware Development Training

CrimsonEDR is an open-source project engineered to identify specific malware patterns, offering a tool for honing skills in circumventing Endpoint Detection and Response (EDR). By leveraging diverse detection methods, it empowers users to deepen their understanding of security evasion tactics.

Features

Detection Description Direct Syscall Detects the usage of direct system calls, often employed by malware to bypass traditional API hooks. NTDLL Unhooking Identifies attempts to unhook functions within the NTDLL library, a common evasion technique. AMSI Patch Detects modifications …

amsi antivirus dll malware scan sign whitelist windows