EDR & Antivirus Bypass to Gain Shell Access
EDR-Antivirus-Bypass-to-Gain-Shell-Access
This repository contains a proof-of-concept (PoC) for bypassing EDR and antivirus solutions using a memory injection technique. The code executes shellcode that spawns a reverse shell, successfully evading detection by various security mechanisms.
This project demonstrates how to bypass EDR and antivirus protection using Windows API functions such as VirtualAlloc, CreateThread, and WaitForSingleObject. The payload is injected directly into the process memory without being detected by security tools, establishing a connection to a remote system for a reverse shell.
Feature
- Bypasses standard EDR and antivirus solutions
- Executes shellcode in memory to create a reverse shell
- Utilizes
VirtualAllocandCreateThreadto inject the payload directly into process memory
