Eyeris | Malware Process Visualizer | EDR Query Build Helper
A Python based tool that when provided a PID of an administrative CMD, acts as a task manager but only for that one process. This is benificial for understanding process flow of malwares so that a pattern can be extracted and an EDR custom query could be built for obvious reasons. This feature is by default present in EDRs but ofcourse personally no one has red team simulation access for research purposes except people working in the EDR company. Anyways Usage: Provide a PID from a CMD. Run a sample malware from the same CMD. Quit the CMD once it's activities are over. This program will generate a Tree-Node structure JSON, that can be analyzed and referenced for building the custom EDR queries.
Link: https://github.com/Vyiel/RedTeamPets/
APT Simulator: https://github.com/NextronSystems/APT...
Thanks.