edrEvasionWorkshop

KO | EN

gitlite — search

#agent #svg #terminal #framework #generative-ai #developer-tools #self-hosted #database #claude-code #kubernetes

edrEvasionWorkshop

(★ 229)

Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel” presented at DEF CON 34 and BSidesLV 2026. Covers malware development, EDR Architecture, EDR evasion, C2 customization, and kernel-level techniques.

File Explorer

ZIP Download

- 1._EDR_Detection_Mechanisms.pdf
- 2.1_Loader_Stomping.pdf
- 2.2_Loader_StackSpoofing.pdf
- 2.3_c2_havocCustomization.pdf
README.md
Step-by-Step Malware Development- Evading EDR from Loaders to the Kernel_full.pdf

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Workshop materials for **“Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel”**, presented at **DEF CON 34** and **BSidesLV 2026**.

This workshop explores custom malware development, EDR Architecture & Evasion, C2 customization, and kernel-level techniques using **Elastic Defend** as the target EDR.

# Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel

Workshop materials from **DEF CON 34** and **BSidesLV 2026**.

The materials cover topics including:

* EDR Architecture
* APC Injection
* Fiber
* Module Stomping
* Call Stack Spoofing
* Indirect Syscalls
* C2 Customization with Havoc
* Kernel-Level Attacks

The workshop focuses on understanding **how EDR detects malicious behavior and how attackers can modify their techniques to evade detection**.

## Notes

The `Reference` directory contains Markdown versions of the workshop materials. These files are provided for **reference only** and have not been thoroughly reviewed or updated.

During the actual workshops, we used slide-based presentation materials.

The source code used in the workshops was shared with workshop participants. I may make the source code publicly available if there is sufficient interest.

## Disclaimer

The techniques and concepts presented in these materials are intended for **educational and security research purposes only**.

Please do not use these techniques for malicious or unauthorized activities.

We hope these materials help you better understand EDR detection and evasion techniques and, ultimately, **improve your security and build stronger defenses**.

edrEvasionWorkshop

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

edrEvasionWorkshop

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README