CCob/SharpBlock

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1171 stars · 165 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SharpBlock is a C# command-line tool that blocks EDR (Endpoint Detection and Response) protection DLLs from executing their entry points in child processes, preventing EDR hooks from being installed. It also includes patchless AMSI and ETW bypasses, process hollowing evasion, command-line argument spoofing, and PPID spoofing for launching implants.

Use cases

• bypass EDR DLL hooks when launching a payload
• run mimikatz without EDR detection
• patchless AMSI bypass in a spawned process
• spoof command line arguments of an implanted process
• load an implant from Cobalt Strike via named pipe
• evade process hollowing detection scanners
• block a specific security product DLL by name or description

When to choose

• you are a red teamer or pentester needing to evade EDR active protection DLLs on Windows
• you want a patchless AMSI/ETW bypass that avoids runtime patch scanners
• you need to launch an implant inside a sacrificial host process with spoofed metadata

When to avoid

• you need a defensive tool to detect or block malware
• your target platform is not Windows x64
• you require a maintained project with a license and recent updates
• you need a GUI or non-.NET environment

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing windows windows cli dotnet edr-bypass amsi-bypass etw-bypass process-hollowing defense-evasion red-team cobalt-strike csharp

Member repositories

For agents

markdown · JSON · MCP: product_card(name="CCob/SharpBlock")