OP 22 December, 2025 - 05:05 AM
Namz_EDR
Namz_EDR is an Endpoint Detection and Response (EDR) tool written in Python for Windows systems. It is designed to help security analysts and system administrators detect, analyze, and respond to suspicious activities and potential threats on endpoints.
Features
- Process Monitoring: Detects suspicious or malicious processes running on the system.
- Persistence Mechanism Detection: Scans for common persistence techniques such as registry autoruns, scheduled tasks, and WMI event subscriptions.
- WMI Persistence Scan: Identifies suspicious WMI event filters and consumers.
- Anti-Forensics Detection: Looks for signs of timestomping and other anti-forensics techniques.
- Network Connections: Lists active network connections and highlights potentially suspicious activity.
- File System Scanning: Checks for suspicious files and directories.
- Logging: Provides detailed logs for all findings and actions.
Requirements
- Windows OS
- Python 3.7 or higher
- Required Python packages (see below)
Usage
Run the tool from the command line:
python Namz_EDR.py
The script will perform a series of security checks and display/log the results.
Disclaimer
This tool is intended for educational and research purposes only. Use it responsibly and only on systems you own or have explicit permission to analyze.
Contributing
Contributions are welcome! Please open issues or submit pull requests for improvements or bug fixes.
