anthrax3 / sharpblock

A method of bypassing EDR's active projection DLL's by preventing entry point exection

SharpBlock

A method of bypassing EDR's active projection DLL's by preventing entry point exection

SharpBlock by @_EthicalChaos_
  DLL Blocking app for child processes

  -e, --exe=VALUE            Program to execute (default cmd.exe)
  -a, --args=VALUE           Arguments for program (default null)
  -n, --name=VALUE           Name of DLL to block
  -c, --copyright=VALUE      Copyright string to block
  -p, --product=VALUE        Product string to block
  -d, --description=VALUE    Description string to block
  -h, --help                 Display this help

Accompanying Blog Post: https://ethicalchaos.dev/2020/06/14/lets-create-an-edr-and-bypass-it-part-2/