Xacone/BestEdrOfTheMarket resource

Health v2 · maintenance only

Adoption not part of the score

1552 stars · 162 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

An open-source lab implementing EDR-style detection capabilities in a Windows kernel driver, covering kernel callbacks, system call interception, VAD-based integrity checks, and Yara rule scanning. It is designed for learning and experimenting with how EDR products detect TTPs like process injection and credential dumping.

Use cases

• understand how EDRs detect process injection from the kernel
• experiment with Windows kernel callbacks and ETW telemetry
• test defense evasion techniques against a lab EDR
• learn about VAD trees and alternative system call handlers
• detect MITRE ATT&CK TTPs like PPID spoofing and thread hijacking
• study kernel driver development for security monitoring

When to choose

• you want a hands-on lab to learn EDR detection internals on Windows
• you are researching kernel-based telemetry and evasion workarounds
• you need a reference implementation of kernel callbacks and syscall interception

When to avoid

• you need a production EDR or real endpoint protection
• you want a user-mode-only monitoring tool
• you are not working on Windows or cannot load kernel drivers

Facets

learning-resource · maturity active

security monitoring developer-tools security operating-systems developer-tools windows cpp edr kernel-driver defense-evasion edr-evasion edr-testing windows-kernel mitre-attack yara security-research

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Xacone/BestEdrOfTheMarket")