{"id":51952287,"url":"https://github.com/benjitrapp/mostshittyedr","last_synced_at":"2026-07-29T07:00:56.319Z","repository":{"id":371495654,"uuid":"1301274092","full_name":"BenjiTrapp/MostShittyEDR","owner":"BenjiTrapp","description":"The World's Most Intentionally Terrible EDR - An educational platform for learning EDR detection and evasion techniques. 20 bypass challenges in Nim.","archived":false,"fork":false,"pushed_at":"2026-07-15T08:32:18.000Z","size":283,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-15T10:21:36.471Z","etag":null,"topics":["bypass-techniques","ctf","edr","edr-bypass","education","kernel-driver","nim","offensive-security","process-monitoring","red-team","security","windows"],"latest_commit_sha":null,"homepage":"https://benjitrapp.github.io/MostShittyEDR/","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BenjiTrapp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-15T06:21:22.000Z","updated_at":"2026-07-15T08:32:30.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/BenjiTrapp/MostShittyEDR","commit_stats":null,"previous_names":["benjitrapp/mostshittyedr"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/BenjiTrapp/MostShittyEDR","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FMostShittyEDR","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FMostShittyEDR/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FMostShittyEDR/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FMostShittyEDR/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BenjiTrapp","download_url":"https://codeload.github.com/BenjiTrapp/MostShittyEDR/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BenjiTrapp%2FMostShittyEDR/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36022278,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-29T02:00:04.910Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bypass-techniques","ctf","edr","edr-bypass","education","kernel-driver","nim","offensive-security","process-monitoring","red-team","security","windows"],"created_at":"2026-07-29T07:00:55.480Z","updated_at":"2026-07-29T07:00:56.295Z","avatar_url":"https://github.com/BenjiTrapp.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg src=\"static/logo.png\" alt=\"MostShittyEDR Logo\" width=\"500\" /\u003e\n\n\u003c/div\u003e\n\u003cbr\u003e\u003cbr\u003e\n\n# MostShittyEDR\n\n### *The World's Most Intentionally Terrible Endpoint Detection \u0026 Response Agent*\n\n[![Nim](https://img.shields.io/badge/Nim-2.0+-yellow.svg?style=flat-square\u0026logo=nim)](https://nim-lang.org/)\n[![License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square)](LICENSE)\n[![Platform](https://img.shields.io/badge/platform-Windows-0078D6.svg?style=flat-square\u0026logo=windows)](https://www.microsoft.com/windows)\n[![Status](https://img.shields.io/badge/status-Educational%20Only-red.svg?style=flat-square)](README.md)\n\n**An educational EDR agent built in Nim with an optional kernel driver for learning detection techniques and their bypasses.**\n\n[Features](#features) • [Quick Start](#quick-start) • [Driver Mode](#kernel-driver-mode) • [Challenges](#the-challenge) • [Architecture](#architecture) • [EDR Explained](https://benjitrapp.github.io/MostShittyEDR/edr-explained/) • [Resources](#resources)\n\n\u003c/div\u003e\n\n---\n\n## Overview\n\n**MostShittyEDR** is a deliberately weak EDR agent designed for **security research**, **education**, and **red team training**. It implements detection methods that mirror real-world EDR engines but with intentional weaknesses mapped to **42 bypass challenges** across **11 categories**.\n\nThe project has two operating modes:\n- **User-mode** (default) — polls processes via Toolhelp32 snapshots\n- **Kernel-mode** (`--driver`) — receives real-time events from a kernel driver via IOCTLs, with kernel-level process blocking, LSASS handle protection, and hardware-enforced kill\n\n\u003e *\"If you can't bypass this, you definitely need more practice\"*\n\n\u003e :warning: **Disclaimer**: This is NOT production security software. It's an educational tool for understanding EDR evasion techniques.\n\n---\n\n## Features\n\n\u003ctable\u003e\n\u003ctr\u003e\n\u003ctd width=\"50%\"\u003e\n\n### 9 Detection Rules\n\n| Rule | Method | Action |\n|------|--------|--------|\n| 1 | Process Name Blacklist (12 names) | **BLOCKS** |\n| 2 | Command Line Keywords (substring) | **BLOCKS** |\n| 3 | Reconnaissance Detection | `discard` |\n| 4 | LSASS Dump Detection (dual condition) | **BLOCKS** |\n| 5 | PowerShell Analysis (flags) | **BLOCKS** |\n| 6 | Hash-Based Detection (SHA256, `--signatures`) | **BLOCKS** |\n| 7 | Hooked API Import Detection (`--profile`) | **ALERTS** |\n| 8 | ETW Integrity Check | **BLOCKS** |\n| 9 | PE Structure Analysis (packer/header) | **ALERTS** |\n\n\u003c/td\u003e\n\u003ctd width=\"50%\"\u003e\n\n### Technical Features\n\n- **Dual-mode monitoring**\n  - User-mode: Toolhelp32 snapshot polling\n  - Kernel-mode: driver callbacks via `--driver`\n\n- **Kernel driver integration**\n  - Process/thread creation callbacks\n  - LSASS handle guard (ObRegisterCallbacks)\n  - Kernel-level process blocking \u0026 termination\n  - Overlapped I/O with async event delivery\n\n- **EDR hook profiles**\n  - Real hook data from CrowdStrike, Carbon Black, Cylance, Bitdefender, Cortex, Checkpoint\n\n- **ETW telemetry**\n  - Custom ETW provider \u0026 trace session\n  - Integrity monitoring (tamper detection)\n\n\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/table\u003e\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- Windows 10/11 (64-bit)\n- [Nim 2.0+](https://nim-lang.org/) with MinGW\n\n```powershell\nwinget install nim-lang.Nim\n```\n\n### Build \u0026 Run\n\n```powershell\n# Install dependencies and build\nmake build\n\n# Or manually:\nnimble install winim -y\nnim c -d:release --opt:size -o:edr_agent.exe src/edr_agent.nim\n\n# Run in detection-only mode\n.\\edr_agent.exe --verbose --no-kill\n\n# Run with hash signatures\n.\\edr_agent.exe --verbose --signatures signatures/malware_hashes.txt\n\n# Run with EDR hook profile\n.\\edr_agent.exe --verbose --profile crowdstrike\n\n# Run with kernel driver (requires loaded driver + admin)\n.\\edr_agent.exe --driver --verbose\n```\n\n### Command-Line Options\n\n| Flag | Description |\n|------|-------------|\n| `--verbose`, `-v` | Show all new processes (not just detections) |\n| `--no-kill`, `-n` | Detect but don't terminate processes |\n| `--interval MS` | Set polling interval in ms (default: 500, min: 50) |\n| `--profile NAME` | Load EDR hook profile for Rule 7 |\n| `--signatures FILE` | Load SHA256 hash signatures for Rule 6 |\n| `--driver` | Connect to kernel driver for real-time monitoring |\n| `--no-etw` | Disable ETW telemetry provider and Rule 8 |\n| `--list-profiles` | Show available hook profiles |\n\n### Lab Usage\n\n```powershell\n# Terminal 1: Start the EDR agent\n.\\edr_agent.exe --verbose --no-kill --signatures signatures/malware_hashes.txt\n\n# Terminal 2: Try to execute commands without being detected\nwhoami          # This WILL be detected (Rule 3, but discarded)\nmimikatz.exe    # This WILL be blocked (Rule 1)\n# Can you find a way that won't be?\n```\n\n---\n\n## Kernel Driver Mode\n\nThe `--driver` flag connects the agent to the kernel driver (`\\\\.\\MostShittyEDR`) for real-time, event-driven monitoring instead of user-mode polling.\n\n### What the driver provides\n\n- **Process creation callbacks** via `PsSetCreateProcessNotifyRoutineEx` — every process start/exit is observed\n- **Thread creation callbacks** via `PsSetCreateThreadNotifyRoutine` — thread lifecycle events\n- **LSASS handle protection** via `ObRegisterCallbacks` — strips `PROCESS_VM_READ` and `PROCESS_QUERY_INFORMATION` from LSASS handles\n- **Kernel-level block rules** — the agent pushes block rules (process name + command-line patterns) to the kernel, which can deny process creation before it starts\n- **Kernel-level process termination** — uses `ZwTerminateProcess` from ring 0 instead of user-mode `TerminateProcess`\n\n### Communication protocol\n\nThe agent communicates with the driver via 5 IOCTLs over `\\\\.\\MostShittyEDR`:\n\n| IOCTL | Code | Direction | Purpose |\n|-------|------|-----------|---------|\n| `WAIT_FOR_EVENT` | `0x222000` | Kernel → Agent | Agent blocks until next event (overlapped I/O) |\n| `KILL_PROCESS` | `0x222004` | Agent → Kernel | Kernel-level process termination |\n| `ADD_BLOCK_RULE` | `0x222008` | Agent → Kernel | Push block rule (image suffix + cmdline substr) |\n| `CLEAR_BLOCK_RULES` | `0x22200C` | Agent → Kernel | Reset all block rules |\n| `SIGNAL_LSASS_DUMP` | `0x222010` | Agent → Kernel | Signal LSASS dump — kernel kills dumper + logs event |\n\n### Driver setup\n\n```powershell\n# Use the install script (requires Administrator)\n.\\install_driver.ps1 -Install\n\n# Or manually:\n# 1. Enable test-signing (one-time, requires reboot)\nbcdedit /set testsigning on\n\n# 2. Register and start the driver\nsc.exe create MostShittyEDR type= kernel binPath= C:\\path\\to\\driver.sys\nsc.exe start MostShittyEDR\n\n# 3. Run the agent with --driver\n.\\edr_agent.exe --driver --verbose\n\n# Uninstall driver only\n.\\install_driver.ps1 -Uninstall\n\n# Uninstall everything (agent + driver)\n.\\uninstall.ps1\n\n# Uninstall everything + remove build artifacts\n.\\uninstall.ps1 -Clean\n```\n\n### User-mode vs Kernel-mode\n\n| | User-mode (default) | Kernel-mode (`--driver`) |\n|---|---|---|\n| **Monitoring** | Toolhelp32 polling (500ms gaps) | Kernel callbacks (no gaps) |\n| **Process blocking** | Kill after detection | Deny creation before start |\n| **LSASS protection** | Keyword matching only | Handle permission stripping |\n| **Process termination** | `TerminateProcess` (user-mode) | `ZwTerminateProcess` (ring 0) |\n| **Evasion difficulty** | Easy (timing, elevation) | Harder (needs kernel access) |\n| **Requirements** | None | WDK, test-signing, Administrator |\n\n---\n\n## The Challenge\n\n\u003e **Can you bypass the EDR?**\n\u003e This agent uses common detection patterns found in real-world EDR products.\n\u003e Your mission: Execute tools and commands without being detected or killed!\n\n### Known Vulnerabilities\n\n- :unlock: Case-sensitive blacklist (`Mimikatz.exe` != `mimikatz.exe`)\n- :unlock: No command-line deobfuscation (carets, env vars, encoding all bypass)\n- :unlock: Recon detection is theater (Rule 3 detects but discards the result)\n- :unlock: LSASS rule needs dual match (rename tool OR omit \"lsass\" keyword)\n- :unlock: Only monitors `powershell.exe` (not `pwsh.exe`)\n- :unlock: Plaintext signature file is readable and exact-match only\n- :unlock: Static import analysis bypassed by dynamic resolution or direct syscalls\n- :unlock: ETW session has hardcoded name, patchable `EtwEventWrite`\n- :unlock: PE analysis has no entropy check, strict parser crashes on corrupted headers\n- :unlock: Polling-based monitoring has timing gaps (without `--driver`)\n- :unlock: Driver device has no access control — any process can send IOCTLs\n- :unlock: Single-slot event delivery is monopolizable (DoS)\n\n### Challenge Categories\n\n| Category | Challenges | Difficulty | Target Rules |\n|----------|-----------|-----------|--------------|\n| **Process Name Evasion** | 01-04 | Easy | Rule 1 |\n| **Command Line Obfuscation** | 05-09 | Easy-Medium | Rules 2, 3, 5 |\n| **Process Monitoring Bypass** | 10-14 | Medium | Architecture, Rule 4 |\n| **Execution Evasion** | 15-18 | Medium-Hard | Architecture, Rule 5 |\n| **Advanced Bypass** | 19-20 | Easy-Hard | Architecture, Rule 6 |\n| **API Hook Evasion** | 21-24 | Medium-Hard | Rule 7 |\n| **ETW Bypass** | 25-28 | Easy-Hard | Rule 8 |\n| **Signature Bypass** | 29-32 | Easy-Hard | Rule 6 |\n| **Packer \u0026 PE Evasion** | 33-36 | Medium-Hard | Rule 9 |\n| **BYOVD / Kernel Attacks** | 37-39 | Hard | Kernel Driver |\n| **IOCTL Abuse** | 40-42 | Medium | Kernel Driver |\n\n**42 challenges** with full solutions at the [Challenge Browser](https://benjitrapp.github.io/MostShittyEDR/challenges/).\n\n---\n\n## Architecture\n\n### Detection Pipeline\n\n```\nProcess Event (polling or kernel callback)\n    |\n    +-\u003e Rule 1: Process Name Blacklist   --\u003e KILL   (case-sensitive!)\n    +-\u003e Rule 2: Command Line Keywords    --\u003e KILL   (no deobfuscation!)\n    +-\u003e Rule 3: Recon Detection          --\u003e discard (never blocks!)\n    +-\u003e Rule 4: LSASS Dump Detection     --\u003e KILL   (needs both conditions!)\n    +-\u003e Rule 5: PowerShell Analysis      --\u003e KILL   (only powershell.exe!)\n    +-\u003e Rule 6: Hash Check (SHA256)      --\u003e KILL   (exact match, on-disk only!)\n    +-\u003e Rule 7: Hooked API Imports       --\u003e ALERT  (static imports only!)\n    +-\u003e Rule 8: ETW Integrity            --\u003e KILL   (user-mode only!)\n    +-\u003e Rule 9: PE Structure Analysis    --\u003e ALERT  (no entropy, strict parser!)\n```\n\n### Dual-Mode Architecture\n\n```mermaid\ngraph TB\n    subgraph Kernel[\"🔒 Kernel Driver (--driver mode)\"]\n        direction TB\n        CB1[\"PsSetCreateProcessNotifyRoutineEx\u003cbr/\u003e→ ProcessCallback\"]\n        CB2[\"PsSetCreateThreadNotifyRoutine\u003cbr/\u003e→ ThreadCallback\"]\n        CB3[\"ObRegisterCallbacks\u003cbr/\u003e→ LsassHandleGuard\"]\n        EQ[\"📋 Event Queue\u003cbr/\u003e(LIST_ENTRY FIFO)\"]\n        BR[\"🚫 Block Rules\u003cbr/\u003e(up to 64)\"]\n        IRP[\"⏳ Pending IRP\u003cbr/\u003e(single-slot)\"]\n\n        CB1 --\u003e EQ\n        CB2 --\u003e EQ\n        CB3 --\u003e EQ\n        BR --\u003e|deny creation| CB1\n        EQ --\u003e IRP\n    end\n\n    subgraph Device[\"IOCTL Interface — \\\\\\\\.\\\\MostShittyEDR\"]\n        direction LR\n        I1[\"WAIT_FOR_EVENT\u003cbr/\u003e0x222000\"]\n        I2[\"KILL_PROCESS\u003cbr/\u003e0x222004\"]\n        I3[\"ADD_BLOCK_RULE\u003cbr/\u003e0x222008\"]\n        I4[\"CLEAR_RULES\u003cbr/\u003e0x22200C\"]\n        I5[\"SIGNAL_LSASS\u003cbr/\u003e0x222010\"]\n    end\n\n    subgraph User[\"🛡️ Nim Agent (edr_agent.exe)\"]\n        direction TB\n        Rules[\"Rules 1-9\"]\n        ETW[\"ETW Telemetry\"]\n        Sigs[\"Hash Signatures\"]\n        Hooks[\"Hook Profiles\"]\n    end\n\n    IRP --\u003e|overlapped I/O| I1\n    I1 --\u003e|EDR_EVENT struct| User\n    User --\u003e|EdrCommand struct| I2\n    User --\u003e|BlockRuleEntry struct| I3\n```\n\n### Project Structure\n\n```\nMostShittyEDR/\n├── src/\n│   ├── edr_agent.nim              # User-mode EDR agent (Nim)\n│   └── driver/\n│       └── driver.cpp             # Kernel driver (C++, WDK required)\n├── tests/\n│   ├── test_rules.nim             # 98 rule + ABI verification tests\n│   ├── test_profiles.nim          # 20 hook profile tests\n│   ├── test_driver_logic.cpp      # 44 driver logic tests (user-mode)\n│   └── test_driver_ioctl.cpp      # Driver IOCTL integration tests\n├── profiles/                      # Real EDR hook profiles\n├── signatures/\n│   └── malware_hashes.txt         # SHA256 signature database\n├── _challenges/                   # 42 bypass challenges\n├── _solutions/                    # Detailed solution walkthroughs\n├── install_driver.ps1             # Driver install/uninstall script\n├── uninstall.ps1                  # Full uninstall (agent + driver + cleanup)\n├── Makefile                       # Build automation\n└── MostShittyEDR.nimble           # Nim package config\n```\n\n---\n\n## Testing\n\n```powershell\n# Run all Nim tests (rules + profiles)\nmake test-nim\n\n# Run driver logic tests (no driver needed)\nmake test-driver-logic\n\n# Run driver IOCTL tests (requires loaded driver + admin)\nmake test-driver-ioctl\n\n# Run all safe tests\nmake test\n```\n\nThe test suite includes **162 tests**:\n- 98 detection rule tests (Rules 1-9, helpers, analysis engine)\n- 24 driver ABI verification tests (struct sizes, field offsets, IOCTL codes)\n- 20 hook profile tests\n- 20 driver logic tests (C++)\n\n---\n\n## Resources\n\n### EDR Internals\n- [EDR Explained (MostShittyEDR)](https://benjitrapp.github.io/MostShittyEDR/edr-explained/) - How real EDRs work\n- [Understanding and Attacking EDRs](https://benjitrapp.github.io/attacks/2024-08-21-edr-and-malware/) - Deep dive into hooking, syscalls, and kernel bypass\n- [EDR Bypass Roadmap](https://benjitrapp.github.io/attacks/2026-01-18-EDR-bypass-roadmap/) - Strategic approach to bypassing EDR\n- [BYOVD \u0026 IOCTL EDR Killer](https://benjitrapp.github.io/attacks/2026-06-24-byovd-ioctl-edr-killer/) - Killing EDR agents via vulnerable driver IOCTLs\n- [ETW-TI Deep Dive](https://benjitrapp.github.io/defenses/2026-06-19-etw-ti/) - Kernel-level telemetry defense\n- [Breaking ETW and EDR](https://benjitrapp.github.io/attacks/2024-02-11-offensive-etw/) - Offensive ETW techniques\n\n### Companion Projects\n- [MostShittyAV](https://github.com/BenjiTrapp/MostShittyAV) - The AMSI bypass companion lab (43 challenges)\n\n### Security Research\n- [MITRE ATT\u0026CK - Defense Evasion](https://attack.mitre.org/tactics/TA0005/)\n- [LOLBAS Project](https://lolbas-project.github.io/) - Living Off The Land Binaries\n- [Mr-Un1k0d3r/EDRs](https://github.com/Mr-Un1k0d3r/EDRs) - EDR hook data (used for profiles)\n- [Astral-PE](https://github.com/DosX-dev/Astral-PE) - PE header obfuscation (Challenge 35)\n- [NimBlackout](https://github.com/Helixo32/NimBlackout) - Nim BYOVD process killer (Challenge 37)\n- [EDRSandblast](https://github.com/wavestone-cdt/EDRSandblast) - Kernel callback removal \u0026 ETW-TI blinding (Challenges 38-39)\n\n---\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n---\n\n## :warning: Legal Notice\n\n**This tool is for educational and research purposes only.**\n\n- :x: Do not use on systems you don't own or have explicit permission to test\n- :x: Do not use for malicious purposes\n- :x: Not a replacement for real endpoint security\n- :white_check_mark: Use in controlled lab environments only\n- :white_check_mark: Understand applicable laws and regulations in your jurisdiction\n\n**The author assumes no liability for misuse of this software.**\n\n---\n\n\u003cdiv align=\"center\"\u003e\n\n### Happy Hunting!\n\n*Made with Nim for the security research community*\n\n**[:star: Star this repo](../../stargazers)** • **[:bug: Report Bug](../../issues)** • **[:bulb: Request Feature](../../issues)**\n\n\u003c/div\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjitrapp%2Fmostshittyedr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbenjitrapp%2Fmostshittyedr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbenjitrapp%2Fmostshittyedr/lists"}