EDR & Antivirus Bypass to Gain Shell Access

EDR-Antivirus-Bypass-to-Gain-Shell-Access

This repository contains a proof-of-concept (PoC) for bypassing EDR and antivirus solutions using a memory injection technique. The code executes shellcode that spawns a reverse shell, successfully evading detection by various security mechanisms.

This project demonstrates how to bypass EDR and antivirus protection using Windows API functions such as VirtualAlloc, CreateThread, and WaitForSingleObject. The payload is injected directly into the process memory without being detected by security tools, establishing a connection to a remote system for a reverse shell.

Feature

• Bypasses standard EDR and antivirus solutions
• Executes shellcode in memory to create a reverse shell
• Utilizes VirtualAlloc and CreateThread to inject the payload directly into process memory

Install & Use

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy