😈 EDRSandBlast: Update
— User-mode (API hooking) evasion;
— Kernel-mode (callbacks and ETW ThreatIntel events) evasion;
— Successively tested on market-leading EDR products.
https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release
#maldev #edr #lsass #evasion #redteam
Post #804
2.08K
APT EDRSandBlast EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Kernel callbacks and ETW TI provider) and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland…
- 👍 3