{"adoption": {"forks": 318, "observed_at": "2026-08-28T04:05:43.327201+00:00", "stars": 1844}, "canonical_url": "https://ross.abutalabs.com/products/edrsandblast", "card": {"archived": false, "artifact_type": "cli-tool", "description": null, "domain": ["security", "penetration-testing", "windows"], "enriched": true, "function": ["security", "penetration-testing", "reverse-engineering"], "health_score": 20, "homepage": null, "language": "C", "license": null, "license_family": "other", "maturity": "maintenance", "member_repos": ["wavestone-cdt/EDRSandblast"], "name": "wavestone-cdt/EDRSandblast", "platform": ["windows", "cli"], "pushed_at": "2024-08-30T20:30:31+00:00", "repo": "wavestone-cdt/EDRSandblast", "stars": 1844, "tags": ["edr-bypass", "red-team", "kernel-exploitation", "lsass-dumping", "offensive-security", "vulnerable-driver", "etw-patching", "userland-unhooking"], "topics": [], "urls": [], "use_cases": ["bypass EDR kernel callbacks to dump LSASS credentials", "remove EDR notify routines from the Windows kernel", "unhook EDR userland DLL hooks before running tooling", "disable ETW Threat Intelligence logging during red team operations", "test EDR product resilience against kernel-level evasion", "strip LSASS process protection (PPL) via kernel write primitives"], "what_it_is": "EDRSandBlast is a C-based offensive security tool that weaponizes vulnerable signed drivers to bypass EDR detections on Windows, including kernel notify routine callbacks, object callbacks, and ETW Threat Intelligence providers. It also implements userland unhooking techniques to evade userland monitoring, enabling actions like LSASS memory dumping without generating detection events.", "when_to_avoid": ["you need a defensive tool to harden systems against such attacks", "you want a general-purpose penetration testing framework", "you need cross-platform support outside Windows", "you require a maintained tool with an explicit license for production use"], "when_to_choose": ["you are a red teamer needing to evade EDR during credential access on Windows", "you are a security researcher studying EDR kernel callback mechanisms", "you need to evaluate how well an EDR detects kernel-mode evasion techniques"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/edrsandblast", "repo": "wavestone-cdt/EDRSandblast", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:43.327201+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:17:56.846599+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7aef80f6c717d68d77b8a6aa014f25ec53001ca7a98eab054e3983a874d8bef7", "fetched_at": "2026-08-28T04:05:43.327201+00:00", "kind": "readme", "missing": false, "url": "https://github.com/wavestone-cdt/EDRSandblast"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1765, "days_push": 733, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}