edrhunt 扫描 windows 服务、驱动程序、进程、注册表以查找已安装的 edr（端点检测和响应）。

安装从发布部分下载最新版本。发行版是为 windows/amd64 构建的。GO安装需要在系统上安装 Go1.17+ 。go install github.com/FourCoreLabs/EDRHunt/cmd/EDRHunt@master用法查找已安装的 EDR代码语言：javascript代码运行次数：0运行复制

$ .\EDRHunt.exe scan[EDR]Detected EDR: Windows DefenderDetected EDR: Kaspersky Security

扫描全部代码语言：javascript代码运行次数：0运行复制

$ .\EDRHunt.exe allRunning in user mode, escalate to admin for more details.Scanning processes, services, drivers, and registry...[PROCESSES]Suspicious Process Name: MsMpEng.exeDescription: MsMpEng.exeCaption: MsMpEng.exeBinary:ProcessID: 6764Parent Process: 1148Process CmdLine :File Metadata:Matched Keyword: [msmpeng]Suspicious Process Name: NisSrv.exeDescription: NisSrv.exeCaption: NisSrv.exeBinary:ProcessID: 9840Parent Process: 1148Process CmdLine :File Metadata:Matched Keyword: [nissrv]...

查找匹配 EDR 关键字的驱动程序代码语言：javascript代码运行次数：0运行复制

    __________  ____     __  ____  ___   ________   / ____/ __ \/ __ \   / / / / / / / | / /_  __/  / __/ / / / / /_/ /  / /_/ / / / /  |/ / / / / /___/ /_/ / _, _/  / __  / /_/ / /|  / / //_____/_____/_/ |_|  /_/ /_/\____/_/ |_/ /_/FourCore Labs (https://fourcore.vision) | Version: 1.1Running in user mode, escalate to admin for more details.[DRIVERS]Suspicious Driver Module: WdFilter.sysDriver FilePath: c:\windows\system32\drivers\wd\wdfilter.sysDriver File Metadata:        ProductName: Microsoft® Windows® Operating System        OriginalFileName: WdFilter.sys        InternalFileName: WdFilter        Company Name: Microsoft Corporation        FileDescription: Microsoft antimalware file system filter driver        ProductVersion: 4.18.2109.6        Comments:        LegalCopyright: © Microsoft Corporation. All rights reserved.        LegalTrademarks:Matched Keyword: [antimalware malware]Suspicious Driver Module: hvsifltr.sysDriver FilePath: c:\windows\system32\drivers\hvsifltr.sysDriver File Metadata:        ProductName: Microsoft® Windows® Operating System        OriginalFileName: hvsifltr.sys.mui        InternalFileName: hvsifltr.sys        Company Name: Microsoft Corporation        FileDescription: Microsoft Defender Application Guard Filter Driver        ProductVersion: 10.0.19041.1        Comments:        LegalCopyright: © Microsoft Corporation. All rights reserved.        LegalTrademarks:Matched Keyword: [defender]Suspicious Driver Module: WdNisDrv.sysDriver FilePath: c:\windows\system32\drivers\wd\wdnisdrv.sysDriver File Metadata:        ProductName: Microsoft® Windows® Operating System        OriginalFileName: wdnisdrv.sys        InternalFileName: wdnisdrv.sys        Company Name: Microsoft Corporation        FileDescription: Windows Defender Network Stream Filter        ProductVersion: 4.18.2109.6        Comments:        LegalCopyright: © Microsoft Corporation. All rights reserved.        LegalTrademarks:Matched Keyword: [defender]...

查找匹配 EDR 关键字的服务代码语言：javascript代码运行次数：0运行复制

$ .\EDRHunt.exe -s

查找匹配 EDR 关键字的驱动程序代码语言：javascript代码运行次数：0运行复制

$ .\EDRHunt.exe -d

查找与 EDR 关键字匹配的注册表项代码语言：javascript代码运行次数：0运行复制

$ .\EDRHunt.exe -r

目前可用的 EDR 检测：

Windows DefenderKaspersky SecuritySymantec SecurityCrowdstrike SecurityMcafee SecurityCylance SecurityCarbon BlackSentinelOneFireEye

https://github.com/FourCoreLabs/EDRHunt