Building a Zero-Dependency 35-in-1 Windows EDR & Memory Forensics Tool in Native C#

说明与用途

ProxSuite 是一个基于原生 C# 的零依赖 Windows EDR 与内存取证工具，提供 35 项安全功能，单个 200 KB 可执行文件即可完成所有任务。

问题

Enterprise security platforms are often large, closed-source, or depend on external services, limiting agility and increasing attack surface.

结果

ProxSuite delivers 35 integrated EDR and memory forensics capabilities in a single, zero‑dependency executable, enabling rapid, antivirus‑clean analysis of Windows endpoints.

工作流

• Compile ProxSuite using csc.exe targeting .NET Framework 4.8.
• Run ProxSuitePRO.exe with desired flags (e.g., --scan, --dump-rwx <PID>, --lolbas).
• Review generated HTML dashboard or JSON findings for analysis.
• Optionally extract shellcode dumps for reverse engineering in Ghidra or x64dbg.
• Use DNS cache entropy feature to detect DGA or tunneling.
• Audit live process command lines for LOLBAS patterns via --lolbas flag.

证据

ProxSuite was engineered with a strict principle: Zero Third-Party Packages: Compiles directly using Microsoft's native .NET Framework 4.8 compiler (csc.exe).

来源

Single, standalone ProxSuitePRO.exe (~200 KB).

来源

Verified 0/0 threats on Microsoft Defender (MpCmdRun.exe).

来源

ProxSuitePRO.exe --dump-rwx <PID> C:\Dumps

来源