MostShittyEDR

MostShittyEDR

The World's Most Intentionally Terrible EDR — an educational platform for understanding EDR detection and evasion techniques.

42
Challenges
11
Categories
42
Solutions

Challenge Categories

Process Name Evasion
Bypass the static process name blacklist through renaming, case tricks, and using unlisted tools.
4 Challenges Easy
Command Line Obfuscation
Evade keyword detection using carets, environment variables, encoding, and discovering dead rules.
5 Challenges Easy - Medium
Process Monitoring Bypass
Exploit polling intervals, pre-existing processes, living-off-the-land, and LSASS dump evasion.
5 Challenges Easy - Medium
Execution Evasion
Alternative PowerShell hosts, privilege escalation, WoW64 tricks, and Unicode abuse.
4 Challenges Medium - Hard
Advanced Bypass
Parent PID spoofing and discovering that hash-based detection is pure security theater.
2 Challenges Easy - Hard
API Hook Evasion
Bypass static import analysis using dynamic resolution, DLL proxying, direct syscalls, and ntdll unhooking. Uses real EDR hook profiles.
4 Challenges Medium - Hard
ETW Bypass
Blind the EDR's ETW telemetry via session killing, EtwEventWrite patching, provider manipulation, and patchless hardware breakpoint hooks.
4 Challenges Easy - Hard
Signature Bypass
Evade SHA256 hash-based detection via byte patching, signature file enumeration, process hollowing, and recompilation.
4 Challenges Easy - Hard
Packer & PE Evasion
Evade PE structure analysis via UPX section renaming, custom packers, Astral-PE header obfuscation, and runtime unpacking.
4 Challenges Medium - Hard
BYOVD / Kernel Attacks
Bring Your Own Vulnerable Driver — kill the EDR, remove kernel callbacks, and blind ETW-TI using signed drivers with kernel R/W primitives.
3 Challenges Hard
IOCTL Abuse
Weaponize the EDR's own unprotected driver device — kill the agent, poison block rules, or steal the event channel. No external driver needed.
3 Challenges Medium
Getting Started
New here? Browse all 42 challenges, pick your difficulty, and start bypassing.
Guide

How It Works

The MostShittyEDR agent implements 9 detection rules with intentional weaknesses:

Rule Method Action Exploitable?
1 Process Name Blacklist (12 names) BLOCKS Yes
2 Command Line Keywords (substring) BLOCKS Yes
3 Reconnaissance Detection discard Yes
4 LSASS Dump Detection (dual condition) BLOCKS Yes
5 PowerShell Analysis (flags) BLOCKS Yes
6 Hash-Based Detection (SHA256, --signatures) BLOCKS Yes
7 Hooked API Import Detection ALERTS Yes
8 ETW Integrity Check BLOCKS Yes
9 PE Structure Analysis (packer/header) ALERTS Yes

Note: This is NOT production security software. It is an educational tool designed for understanding EDR evasion techniques in a safe, controlled environment.

Quick Start

# Clone the repository
git clone https://github.com/BenjiTrapp/MostShittyEDR.git

# Build the EDR agent
make build

# Run in safe mode (detect only, no kills)
.\edr_agent.exe --verbose --no-kill

# Run with kernel driver (requires loaded driver + admin)
.\edr_agent.exe --driver --verbose

Browse the Challenges to begin, or check the MostShittyAV companion lab for AMSI bypass challenges.

Further Reading

Deep-dive blog posts on EDR internals, bypass techniques, and defensive telemetry:

EDR Deep Dive
Understanding and Attacking EDRs
How malware detection works, EDR internals, API/kernel hooking, and attack strategies against EDR solutions.
 Detection
Hunting the Watchers: Detecting EDR Hooks
Techniques to detect and identify EDR hooks in user-mode DLLs, including syscall stub analysis.
 Roadmap
EDR Bypass Roadmap
A structured path through EDR bypass techniques, from basic evasion to advanced kernel-level attacks.
 Syscalls
Hell's Gate, Heaven's Gate & Tartarus Gate
Direct and indirect syscall techniques to bypass user-mode EDR hooks entirely.
 BYOVD
BYOVD & IOCTL EDR Killer
Using vulnerable signed drivers to kill EDR agents from kernel level via IOCTL-based process termination and callback removal.
 Telemetry
ETW-TI Deep Dive
Understanding Event Tracing for Windows Threat Intelligence — the kernel-level telemetry that feeds modern EDRs.
 Offense
Breaking ETW and EDR
Offensive techniques to blind EDR telemetry by tampering with ETW providers and consumers.