DEV Community

çınar
çınar

Posted on

Building a Zero-Dependency 35-in-1 Windows EDR & Memory Forensics Tool in Native C#

#csharp #security #opensource #microsoft

Hey developers and security analysts! 👋

Today I'm open-sourcing ProxSuite v3.0 under the permissive MIT License — a standalone 35-in-1 Windows endpoint detection and live memory forensics engine written entirely in native C# / Win32.

⭐ Source Code & Binary: https://github.com/prox0959/ProxSuite-PRO

💡 Why Native C# with Zero Dependencies?

Most enterprise security platforms are massive, closed-source, or heavily reliant on external services. ProxSuite was engineered with a strict principle:

  • Zero Third-Party Packages: Compiles directly using Microsoft's native .NET Framework 4.8 compiler (csc.exe).
  • Zero External DLLs: Single, standalone ProxSuitePRO.exe (~200 KB).
  • 100% Antivirus Clean: Verified 0/0 threats on Microsoft Defender (MpCmdRun.exe).

🛡️ Core Capabilities:

  1. Live Memory Forensics: Scans for unbacked private RWX pages, Process Hollowing, and Module Stomping (comparing in-memory .text sections against disk PE binaries).
  2. NTDLL Syscall Prologue Audit: Verifies syscall stubs (4C 8B D1 B8) and SSNs to detect user-mode unhooking.
  3. Live RWX Shellcode Dumper (CLI): Extracts unbacked executable memory stubs directly to raw .bin files (ProxSuitePRO.exe --dump-rwx <PID>) for reverse engineering in Ghidra or x64dbg.
  4. WMI LOLBAS Command Hunter: Audits live process command lines for MITRE ATT&CK LOLBIN patterns (certutil, powershell -enc, mshta, rundll32, bitsadmin).
  5. DNS Cache & DGA Sentinel: Computes Shannon entropy on the active DNS resolution cache to expose algorithmically generated C2 domains and DNS tunneling exfiltration.
  6. Executive HTML5 Dark-Mode Dashboard: Generates offline, interactive telemetry reports.

💻 Hybrid GUI & CLI Mode

ProxSuite seamlessly switches between a desktop GUI dashboard and a command-line utility for automation:


cmd
# Automated 35-engine sweep with HTML & JSON output
ProxSuitePRO.exe --scan --html --json findings.json

# Extract shellcode from a suspect process
ProxSuitePRO.exe --dump-rwx 8412 C:\Dumps

# Immediate LOLBAS command-line audit
ProxSuitePRO.exe --lolbas
Enter fullscreen mode Exit fullscreen mode

Top comments (0)