{"adoption": {"forks": 165, "observed_at": "2026-08-28T04:03:51.532023+00:00", "stars": 1171}, "canonical_url": "https://ross.abutalabs.com/products/sharpblock", "card": {"archived": false, "artifact_type": "cli-tool", "description": "A method of bypassing EDR's active projection DLL's by preventing entry point exection", "domain": ["security", "penetration-testing", "windows"], "enriched": true, "function": ["security", "penetration-testing", "cli"], "health_score": 20, "homepage": null, "language": "C#", "license": null, "license_family": "other", "maturity": "maintenance", "member_repos": ["CCob/SharpBlock"], "name": "CCob/SharpBlock", "platform": ["windows", "cli", "dotnet"], "pushed_at": "2021-03-31T09:44:48+00:00", "repo": "CCob/SharpBlock", "stars": 1171, "tags": ["edr-bypass", "amsi-bypass", "etw-bypass", "process-hollowing", "defense-evasion", "red-team", "cobalt-strike", "csharp"], "topics": [], "urls": [], "use_cases": ["bypass EDR DLL hooks when launching a payload", "run mimikatz without EDR detection", "patchless AMSI bypass in a spawned process", "spoof command line arguments of an implanted process", "load an implant from Cobalt Strike via named pipe", "evade process hollowing detection scanners", "block a specific security product DLL by name or description"], "what_it_is": "SharpBlock is a C# command-line tool that blocks EDR (Endpoint Detection and Response) protection DLLs from executing their entry points in child processes, preventing EDR hooks from being installed. It also includes patchless AMSI and ETW bypasses, process hollowing evasion, command-line argument spoofing, and PPID spoofing for launching implants.", "when_to_avoid": ["you need a defensive tool to detect or block malware", "your target platform is not Windows x64", "you require a maintained project with a license and recent updates", "you need a GUI or non-.NET environment"], "when_to_choose": ["you are a red teamer or pentester needing to evade EDR active protection DLLs on Windows", "you want a patchless AMSI/ETW bypass that avoids runtime patch scanners", "you need to launch an implant inside a sacrificial host process with spoofed metadata"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sharpblock", "repo": "CCob/SharpBlock", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:03:51.532023+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T06:28:28.989004+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "7552b6653082e05b4a416f1b3b4d7b2229cfa9d2a5974fa52e60003b50bd4517", "fetched_at": "2026-08-28T04:03:51.532023+00:00", "kind": "readme", "missing": false, "url": "https://github.com/CCob/SharpBlock"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2271, "days_push": 1981, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}