Helixo

CrimsonEDR. Simulate the behavior of AV/EDR for malware development training.

NimBlackout. Kill AV/EDR leveraging BYOVD attack

SimpleEDR. Simple EDR that injects a DLL into a process to place a hook on specific Windows API

GetSystem-LCI. GetSystem-LCI is a PowerShell script to escalate privileges from Administrator to NT AUTHORITY\SYSTEM by abusing LanguageComponentsInstaller.

NimReflectiveLoader. NimReflectiveLoader is a Nim-based tool for in-memory DLL execution using Reflective DLL Loading.

DetectHooks. Detect userland hooks placed by AV/EDR