edr topic

Carbon Black API - Python language bindings

carbonblack

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices...

bytedance

iMonitor（冰镜 - 终端行为分析系统）

wecooperate

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

xuanxuan0

Windows user-land hooks manipulation tool.

ars3n11

Tools to automate and/or expedite response.

redcanaryco

SysEye是一个window上的基于att&ck现代EDR设计思想的威胁响应工具.有效检测常见的未知威胁与已知威胁.防守方的利剑

huoji120

WhiteBeam: Transparent endpoint security

WhiteBeamSec

Automating EDR Testing with reference to MITRE ATTACK via Cobalt Strike [Purple Team].

TH3xACE

Sysmon EDR POC Build within Powershell to prove ability.

ion-storm