# CCob/SharpBlock

A method of bypassing EDR's active projection DLL's by preventing entry point exection

Repository: https://github.com/CCob/SharpBlock
Canonical: https://ross.abutalabs.com/products/sharpblock
Language: C#
License Family: other
Last push: 2021-03-31T09:44:48+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2271, "days_push": 1981, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1171, forks 165 (observed 2026-08-28T04:03:51.532023+00:00)

## What it is
SharpBlock is a C# command-line tool that blocks EDR (Endpoint Detection and Response) protection DLLs from executing their entry points in child processes, preventing EDR hooks from being installed. It also includes patchless AMSI and ETW bypasses, process hollowing evasion, command-line argument spoofing, and PPID spoofing for launching implants.

## Use cases
- bypass EDR DLL hooks when launching a payload
- run mimikatz without EDR detection
- patchless AMSI bypass in a spawned process
- spoof command line arguments of an implanted process
- load an implant from Cobalt Strike via named pipe
- evade process hollowing detection scanners
- block a specific security product DLL by name or description

## When to choose
- you are a red teamer or pentester needing to evade EDR active protection DLLs on Windows
- you want a patchless AMSI/ETW bypass that avoids runtime patch scanners
- you need to launch an implant inside a sacrificial host process with spoofed metadata

## When to avoid
- you need a defensive tool to detect or block malware
- your target platform is not Windows x64
- you require a maintained project with a license and recent updates
- you need a GUI or non-.NET environment

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, cli
- domain: security, penetration-testing, windows
- platform: windows, cli, dotnet
- tags: edr-bypass, amsi-bypass, etw-bypass, process-hollowing, defense-evasion, red-team, cobalt-strike, csharp

## Member repositories
- CCob/SharpBlock (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:51.532023+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:28:28.989004+00:00, confidence not recorded.
  - readme: https://github.com/CCob/SharpBlock (fetched 2026-08-28T04:03:51.532023+00:00, sha 7552b6653082)
- Data as of 2026-08-30T08:39:29.467469+00:00.