edrhunt 扫描 windows 服务、驱动程序、进程、注册表以查找已安装的 edr（端点检测和响应）。
安装从发布部分下载最新版本。发行版是为 windows/amd64 构建的。GO安装需要在系统上安装 Go1.17+ 。go install github.com/FourCoreLabs/EDRHunt/cmd/EDRHunt@master用法查找已安装的 EDR代码语言：javascript代码运行次数：0运行复制
$ .EDRHunt.exe scan[EDR]Detected EDR: Windows DefenderDetected EDR: Kaspersky Security扫描全部代码语言：javascript代码运行次数：0运行复制
$ .EDRHunt.exe allRunning in user mode, escalate to admin for more details.Scanning processes, services, drivers, and registry...[PROCESSES]Suspicious Process Name: MsMpEng.exeDescription: MsMpEng.exeCaption: MsMpEng.exeBinary:ProcessID: 6764Parent Process: 1148Process CmdLine :File Metadata:Matched Keyword: [msmpeng]Suspicious Process Name: NisSrv.exeDescription: NisSrv.exeCaption: NisSrv.exeBinary:ProcessID: 9840Parent Process: 1148Process CmdLine :File Metadata:Matched Keyword: [nissrv]...查找匹配 EDR 关键字的驱动程序代码语言：javascript代码运行次数：0运行复制
__________ ____ __ ____ ___ ________ / ____/ __ / __ / / / / / / / | / /_ __/ / __/ / / / / /_/ / / /_/ / / / / |/ / / / / /___/ /_/ / _, _/ / __ / /_/ / /| / / //_____/_____/_/ |_| /_/ /_/____/_/ |_/ /_/FourCore Labs (https://fourcore.vision) | Version: 1.1Running in user mode, escalate to admin for more details.[DRIVERS]Suspicious Driver Module: WdFilter.sysDriver FilePath: c:windowssystem32driverswdwdfilter.sysDriver File Metadata: ProductName: Microsoft® Windows® Operating System OriginalFileName: WdFilter.sys InternalFileName: WdFilter Company Name: Microsoft Corporation FileDescription: Microsoft antimalware file system filter driver ProductVersion: 4.18.2109.6 Comments: LegalCopyright: © Microsoft Corporation. All rights reserved. LegalTrademarks:Matched Keyword: [antimalware malware]Suspicious Driver Module: hvsifltr.sysDriver FilePath: c:windowssystem32drivershvsifltr.sysDriver File Metadata: ProductName: Microsoft® Windows® Operating System OriginalFileName: hvsifltr.sys.mui InternalFileName: hvsifltr.sys Company Name: Microsoft Corporation FileDescription: Microsoft Defender Application Guard Filter Driver ProductVersion: 10.0.19041.1 Comments: LegalCopyright: © Microsoft Corporation. All rights reserved. LegalTrademarks:Matched Keyword: [defender]Suspicious Driver Module: WdNisDrv.sysDriver FilePath: c:windowssystem32driverswdwdnisdrv.sysDriver File Metadata: ProductName: Microsoft® Windows® Operating System OriginalFileName: wdnisdrv.sys InternalFileName: wdnisdrv.sys Company Name: Microsoft Corporation FileDescription: Windows Defender Network Stream Filter ProductVersion: 4.18.2109.6 Comments: LegalCopyright: © Microsoft Corporation. All rights reserved. LegalTrademarks:Matched Keyword: [defender]...查找匹配 EDR 关键字的服务代码语言：javascript代码运行次数：0运行复制
$ .EDRHunt.exe -s查找匹配 EDR 关键字的驱动程序代码语言：javascript代码运行次数：0运行复制
$ .EDRHunt.exe -d查找与 EDR 关键字匹配的注册表项代码语言：javascript代码运行次数：0运行复制
$ .EDRHunt.exe -r目前可用的 EDR 检测：
Windows DefenderKaspersky SecuritySymantec SecurityCrowdstrike SecurityMcafee SecurityCylance SecurityCarbon BlackSentinelOneFireEye
https://github.com/FourCoreLabs/EDRHunt
Calliper 文档对比神器
文档内容对比神器
28 查看详情 
以上就是神兵利器 – EDRHunt的详细内容，更多请关注创想鸟其它相关文章！
版权声明：本文内容由互联网用户自发贡献，该文观点仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。
如发现本站有涉嫌抄袭侵权/违法违规的内容， 请发送邮件至 chuangxiangniao@163.com 举报，一经查实，本站将立刻删除。
发布者：程序猿，转转请注明出处：https://www.chuangxiangniao.com/p/455626.html
微信扫一扫 
支付宝扫一扫 
