wavestone-cdt/EDRSandblast

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1844 stars · 318 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

EDRSandBlast is a C-based offensive security tool that weaponizes vulnerable signed drivers to bypass EDR detections on Windows, including kernel notify routine callbacks, object callbacks, and ETW Threat Intelligence providers. It also implements userland unhooking techniques to evade userland monitoring, enabling actions like LSASS memory dumping without generating detection events.

Use cases

• bypass EDR kernel callbacks to dump LSASS credentials
• remove EDR notify routines from the Windows kernel
• unhook EDR userland DLL hooks before running tooling
• disable ETW Threat Intelligence logging during red team operations
• test EDR product resilience against kernel-level evasion
• strip LSASS process protection (PPL) via kernel write primitives

When to choose

• you are a red teamer needing to evade EDR during credential access on Windows
• you are a security researcher studying EDR kernel callback mechanisms
• you need to evaluate how well an EDR detects kernel-mode evasion techniques

When to avoid

• you need a defensive tool to harden systems against such attacks
• you want a general-purpose penetration testing framework
• you need cross-platform support outside Windows
• you require a maintained tool with an explicit license for production use

Facets

cli-tool · maturity maintenance

security penetration-testing reverse-engineering security penetration-testing windows windows cli edr-bypass red-team kernel-exploitation lsass-dumping offensive-security vulnerable-driver etw-patching userland-unhooking

Member repositories

For agents

markdown · JSON · MCP: product_card(name="wavestone-cdt/EDRSandblast")