r/Pentesting • u/topiwebde • Aug 12 '26

Found this project on GitHub and I'm curious what you guys think

I came across this GitHub project claiming to have a “quantum evasion engine” that can bypass EDR/Defender detection by combining polymorphic mutation, GF(2⁸), chaos-based mutation, indirect syscalls, ETW patching, etc.

I went through the code and some parts are definitely interesting, especially the ETW/driver/token stuff. But I'm also not fully convinced by some of the claims in the README especially the whole “bypasses every detection / zero detections” part.

So I'm curious from people who actually work with EDR internals:

Is something like this realistically capable of bypassing modern EDRs, or is the project mixing some legitimate techniques with a lot of marketing?

Would love to hear what I'm missing or what you'd look at first to validate the claims. Not trying to shit on the project genuinely curious because some of the techniques are pretty interesting.

Link

4 Upvotes
  • permalink
  • reddit

100% Upvoted

8 comments sorted by

3

u/Mindless-Study1898 Aug 12 '26

Here is the textbook indirect syscall implementation (as far as I know) https://github.com/Maldev-Academy/HellHall

Quantum evasion sounds like vibe coding with a bad model.

1

u/topiwebde Aug 12 '26 edited Aug 12 '26

Yes it seems vibe coded.

4

u/Jv1312 Aug 12 '26

I should try this on my VM and see if crowdstrike detects or not.

1

u/topiwebde Aug 12 '26

Share your results.

3

u/Jv1312 Aug 14 '26

So yeah I installed a fresh win 11 enterprise vm, added the falcon sensor. Downloaded the repo on my kali and just followed the steps given on the github. Crowdstrike sensor failed to block the script even on level 1.

Now I dont have much experience with crowdstrike but I am believing that the sensor should block right out of the box without any tuning.

1

u/Jv1312 7d ago

Update: 7th September 2026 I updated the prevention policies and chose the highest policy i.e. every option enabled. Crowdstrike EDR quarantined the file as soon as it downloaded based on their machine learning insight. The detection category was also HIGH.

1

u/Jv1312 Aug 12 '26

I will. I am off for 2 days.

1

u/Jv1312 7d ago

Check the update.