Building a Zero-Dependency 35-in-1 Windows EDR & Memory Forensics Tool in Native C#

Description and use

ProxSuite is a standalone Windows EDR and memory forensics tool written in native C# with zero third‑party dependencies, offering 35 security functions in a single 200 KB executable.

Problem

Enterprise security platforms are often large, closed-source, or depend on external services, limiting agility and increasing attack surface.

Outcome

ProxSuite delivers 35 integrated EDR and memory forensics capabilities in a single, zero‑dependency executable, enabling rapid, antivirus‑clean analysis of Windows endpoints.

Workflow

• Compile ProxSuite using csc.exe targeting .NET Framework 4.8.
• Run ProxSuitePRO.exe with desired flags (e.g., --scan, --dump-rwx <PID>, --lolbas).
• Review generated HTML dashboard or JSON findings for analysis.
• Optionally extract shellcode dumps for reverse engineering in Ghidra or x64dbg.
• Use DNS cache entropy feature to detect DGA or tunneling.
• Audit live process command lines for LOLBAS patterns via --lolbas flag.

Evidence

ProxSuite was engineered with a strict principle: Zero Third-Party Packages: Compiles directly using Microsoft's native .NET Framework 4.8 compiler (csc.exe).

Source

Single, standalone ProxSuitePRO.exe (~200 KB).

Source

Verified 0/0 threats on Microsoft Defender (MpCmdRun.exe).

Source

ProxSuitePRO.exe --dump-rwx <PID> C:\Dumps

Source