A repost from LinkedIn but: I recently pushed v1 of a Windows EDR prototype I built in C/C++. Kernel…
Nikola M. — SOC / Security Analyst | Detection Engineering, Malware Analysis, Windows Internals | SC-200 · BTL1 · BTLO Top 1%
A repost from LinkedIn but:
I recently pushed v1 of a Windows EDR prototype I built in C/C++.
Kernel callbacks + user-mode hook DLL feeding a userland detection engine. Detects three in-memory injection techniques: process hollowing, shellcode remote thread, and image-based injection.
Validated against real malware, including a sample that bypassed Microsoft Defender at time of testing.
Architecture, detection logic, evidence, and known limitations are documented in the repo:
https://github.com/Oligo12/cyber-projects/tree/main/edr-project
4 reactions · 0 comments