edrhunt 扫描 windows 服务、驱动程序、进程、注册表以查找已安装的 edr（端点检测和响应）。
go install github.com/FourCoreLabs/EDRHunt/cmd/EDRHunt@master用法查找已安装的 EDR代码语言：javascript代码运行次数：0运行复制<code class="javascript">$ .\EDRHunt.exe scan[EDR]Detected EDR: Windows DefenderDetected EDR: Kaspersky Security</code>扫描全部代码语言：javascript代码运行次数：0运行复制
<code class="javascript">$ .\EDRHunt.exe allRunning in user mode, escalate to admin for more details.Scanning processes, services, drivers, and registry...[PROCESSES]Suspicious Process Name: MsMpEng.exeDescription: MsMpEng.exeCaption: MsMpEng.exeBinary:ProcessID: 6764Parent Process: 1148Process CmdLine :File Metadata:Matched Keyword: [msmpeng]Suspicious Process Name: NisSrv.exeDescription: NisSrv.exeCaption: NisSrv.exeBinary:ProcessID: 9840Parent Process: 1148Process CmdLine :File Metadata:Matched Keyword: [nissrv]...</code>查找匹配 EDR 关键字的驱动程序代码语言：javascript代码运行次数：0运行复制
<code class="javascript"> __________ ____ __ ____ ___ ________ / ____/ __ \/ __ \ / / / / / / / | / /_ __/ / __/ / / / / /_/ / / /_/ / / / / |/ / / / / /___/ /_/ / _, _/ / __ / /_/ / /| / / //_____/_____/_/ |_| /_/ /_/\____/_/ |_/ /_/FourCore Labs (https://fourcore.vision) | Version: 1.1Running in user mode, escalate to admin for more details.[DRIVERS]Suspicious Driver Module: WdFilter.sysDriver FilePath: c:\windows\system32\drivers\wd\wdfilter.sysDriver File Metadata: ProductName: Microsoft® Windows® Operating System OriginalFileName: WdFilter.sys InternalFileName: WdFilter Company Name: Microsoft Corporation FileDescription: Microsoft antimalware file system filter driver ProductVersion: 4.18.2109.6 Comments: LegalCopyright: © Microsoft Corporation. All rights reserved. LegalTrademarks:Matched Keyword: [antimalware malware]Suspicious Driver Module: hvsifltr.sysDriver FilePath: c:\windows\system32\drivers\hvsifltr.sysDriver File Metadata: ProductName: Microsoft® Windows® Operating System OriginalFileName: hvsifltr.sys.mui InternalFileName: hvsifltr.sys Company Name: Microsoft Corporation FileDescription: Microsoft Defender Application Guard Filter Driver ProductVersion: 10.0.19041.1 Comments: LegalCopyright: © Microsoft Corporation. All rights reserved. LegalTrademarks:Matched Keyword: [defender]Suspicious Driver Module: WdNisDrv.sysDriver FilePath: c:\windows\system32\drivers\wd\wdnisdrv.sysDriver File Metadata: ProductName: Microsoft® Windows® Operating System OriginalFileName: wdnisdrv.sys InternalFileName: wdnisdrv.sys Company Name: Microsoft Corporation FileDescription: Windows Defender Network Stream Filter ProductVersion: 4.18.2109.6 Comments: LegalCopyright: © Microsoft Corporation. All rights reserved. LegalTrademarks:Matched Keyword: [defender]...</code>查找匹配 EDR 关键字的服务代码语言：javascript代码运行次数：0运行复制
<code class="javascript">$ .\EDRHunt.exe -s</code>查找匹配 EDR 关键字的驱动程序代码语言：javascript代码运行次数：0运行复制
<code class="javascript">$ .\EDRHunt.exe -d</code>查找与 EDR 关键字匹配的注册表项代码语言：javascript代码运行次数：0运行复制
<code class="javascript">$ .\EDRHunt.exe -r</code>
目前可用的 EDR 检测：
万通CMS企业网站系统2.6.3
下载
万通CMS网站管理系统采用PHP+MYSQL技术，支持伪静态功能，可生成google和百度地图，支持自定义url、关键字和描述，利于SEO搜索。拥有企业网站常用的模块功能(企业简介功能、新闻功能、产品功能、下载功能、图片功能、案例功能、在线留言、在线订单、友情链接、网站地图等等)，功能强大，操作简单，灵活实用，是企业建站的神兵利器。我们的愿望是：让每个人都能用上 好用，实用，美观的网站，因为建站如
https://github.com/FourCoreLabs/EDRHunt
