# wavestone-cdt/EDRSandblast

Repository: https://github.com/wavestone-cdt/EDRSandblast
Canonical: https://ross.abutalabs.com/products/edrsandblast
Language: C
License Family: other
Last push: 2024-08-30T20:30:31+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 1765, "days_push": 733, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1844, forks 318 (observed 2026-08-28T04:05:43.327201+00:00)

## What it is
EDRSandBlast is a C-based offensive security tool that weaponizes vulnerable signed drivers to bypass EDR detections on Windows, including kernel notify routine callbacks, object callbacks, and ETW Threat Intelligence providers. It also implements userland unhooking techniques to evade userland monitoring, enabling actions like LSASS memory dumping without generating detection events.

## Use cases
- bypass EDR kernel callbacks to dump LSASS credentials
- remove EDR notify routines from the Windows kernel
- unhook EDR userland DLL hooks before running tooling
- disable ETW Threat Intelligence logging during red team operations
- test EDR product resilience against kernel-level evasion
- strip LSASS process protection (PPL) via kernel write primitives

## When to choose
- you are a red teamer needing to evade EDR during credential access on Windows
- you are a security researcher studying EDR kernel callback mechanisms
- you need to evaluate how well an EDR detects kernel-mode evasion techniques

## When to avoid
- you need a defensive tool to harden systems against such attacks
- you want a general-purpose penetration testing framework
- you need cross-platform support outside Windows
- you require a maintained tool with an explicit license for production use

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, reverse-engineering
- domain: security, penetration-testing, windows
- platform: windows, cli
- tags: edr-bypass, red-team, kernel-exploitation, lsass-dumping, offensive-security, vulnerable-driver, etw-patching, userland-unhooking

## Member repositories
- wavestone-cdt/EDRSandblast (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:43.327201+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:17:56.846599+00:00, confidence not recorded.
  - readme: https://github.com/wavestone-cdt/EDRSandblast (fetched 2026-08-28T04:05:43.327201+00:00, sha 7aef80f6c717)
- Data as of 2026-08-30T08:39:29.467469+00:00.