rkervella/carbonmonoxide

CarbonMonoxide is a security research tool designed to help test whether endpoint detection and response (EDR) systems, the software companies use to catch malware and intrusions, can actually spot sneaky techniques that real attackers use. In simple terms, it's a proof-of-concept that bundles several known evasion methods together to see if security tools are doing their job. At a high level, it combines four techniques. "PPID spoofing" makes a program pretend it was launched by a different, trusted program. "CmdLine spoofing" hides what a program was actually told to do. "QAPC injection" is a way for one process to force another to run code. And "TikiTorch" is an existing tool used in red team exercises (simulated attacks) that works with Cobalt Strike, a commercial penetration testing platform. By chaining these together, the project creates a harder-to-detect scenario for EDR products. The people who would use this are security researchers and red team operators, the professionals organizations hire to simulate real attacks and find gaps in their defenses. For example, if a company wants to verify their EDR catches process injection attacks, they might run this against it to find out. It's essentially a testing tool, not something for production environments. The README is sparse and marks the project as "work in progress," so it doesn't provide setup instructions, usage examples, or detailed explanations beyond listing the four techniques. This isn't a polished product, it reads more like an experiment or reference implementation for people who already understand these concepts and want to see them combined in practice.