# Xacone/BestEdrOfTheMarket

EDR Lab for Experimentation Purposes

Repository: https://github.com/Xacone/BestEdrOfTheMarket
Canonical: https://ross.abutalabs.com/products/bestedrofthemarket
Homepage: https://xacone.github.io/BestEdrOfTheMarketV3.html
Language: C++
License: MIT
License Family: permissive
Topics: edr, defense-evasion, edr-evasion, edr-testing, kernel-development, kernel-driver
Last push: 2026-06-10T19:30:57+00:00

## Health v2 (maintenance only)
Score: 56/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 8, longevity 73
- inputs: {"age_days": 1025, "days_push": 84, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1552, forks 162 (observed 2026-08-28T04:05:02.355496+00:00)

## What it is
An open-source lab implementing EDR-style detection capabilities in a Windows kernel driver, covering kernel callbacks, system call interception, VAD-based integrity checks, and Yara rule scanning. It is designed for learning and experimenting with how EDR products detect TTPs like process injection and credential dumping.

## Use cases
- understand how EDRs detect process injection from the kernel
- experiment with Windows kernel callbacks and ETW telemetry
- test defense evasion techniques against a lab EDR
- learn about VAD trees and alternative system call handlers
- detect MITRE ATT&CK TTPs like PPID spoofing and thread hijacking
- study kernel driver development for security monitoring

## When to choose
- you want a hands-on lab to learn EDR detection internals on Windows
- you are researching kernel-based telemetry and evasion workarounds
- you need a reference implementation of kernel callbacks and syscall interception

## When to avoid
- you need a production EDR or real endpoint protection
- you want a user-mode-only monitoring tool
- you are not working on Windows or cannot load kernel drivers

## Facets
- artifact type: learning-resource
- maturity: active
- function: security, monitoring, developer-tools
- domain: security, operating-systems, developer-tools
- platform: windows, cpp
- tags: edr, kernel-driver, defense-evasion, edr-evasion, edr-testing, windows-kernel, mitre-attack, yara, security-research

## Member repositories
- Xacone/BestEdrOfTheMarket (main) score 56

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:02.355496+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:30:11.320275+00:00, confidence not recorded.
  - readme: https://github.com/Xacone/BestEdrOfTheMarket (fetched 2026-08-28T04:05:02.355496+00:00, sha 2f2241ce8d4d)
  - homepage: https://xacone.github.io/BestEdrOfTheMarketV3.html (fetched 2026-08-29T11:30:33.941402+00:00, sha c7254598d5c6)
- Data as of 2026-08-30T08:39:29.467469+00:00.