Bypass EDR Detection with CrimsonEDR

by ddos · February 27, 2025

CrimsonEDR

CrimsonEDR is an open-source project engineered to identify specific malware patterns, offering a tool for honing skills in circumventing Endpoint Detection and Response (EDR). By leveraging diverse detection methods, it empowers users to deepen their understanding of security evasion tactics.

Features

Detection	Description
Direct Syscall	Detects the usage of direct system calls, often employed by malware to bypass traditional API hooks.
NTDLL Unhooking	Identifies attempts to unhook functions within the NTDLL library, a common evasion technique.
AMSI Patch	Detects modifications to the Anti-Malware Scan Interface (AMSI) through byte-level analysis.
ETW Patch	Detects byte-level alterations to Event Tracing for Windows (ETW), commonly manipulated by malware to evade detection.
PE Stomping	Identifies instances of PE (Portable Executable) stomping.
Reflective PE Loading	Detects the reflective loading of PE files, a technique employed by malware to avoid static analysis.
Unbacked Thread Origin	Identifies threads originating from unbacked memory regions, often indicative of malicious activity.
Unbacked Thread Start Address	Detects threads with start addresses pointing to unbacked memory, a potential sign of code injection.
API hooking	Places a hook on the NtWriteVirtualMemory function to monitor memory modifications.
Custom Pattern Search	Allows users to search for specific patterns provided in a JSON file, facilitating the identification of known malware signatures.

Warning

Windows Defender and other antivirus programs may flag the DLL as malicious due to its content containing bytes used to verify if the AMSI has been patched. Please ensure to whitelist the DLL or disable your antivirus temporarily when using CrimsonEDR to avoid any interruptions.