Av Edr Evasion
This skill teaches authorized penetration testers how to evade antivirus and EDR systems blocking payload execution. It covers custom DLL and EXE compilation using mingw and Go, AMSI bypass for PowerShell, shellcode alternatives, and ETW patching—all grounded in documented techniques and stopping before C2 setup or persistence.
Av Edr Evasion teaches custom payload compilation and runtime detection bypass for authorized security testing.
AI-generated summary based on this skill's SKILL.md
Install
blacklanternsecurity/red-run/av-edr-evasion · repository language: Python
git clone https://github.com/blacklanternsecurity/red-run
cp -r red-run ~/.claude/skills/av-edr-evasiongenerated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
npx skillfed install blacklanternsecurity/red-run/av-edr-evasionFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What antivirus evasion techniques does Av Edr Evasion cover?
Av Edr Evasion teaches authorized penetration testers documented methods to evade antivirus and EDR systems. The skill covers custom DLL and EXE compilation using mingw and Go, AMSI bypass for PowerShell, shellcode alternatives, and ETW patching. These techniques are designed to help security professionals understand how payloads can bypass detection during authorized testing engagements.
How can I bypass EDR detection with Av Edr Evasion?
Av Edr Evasion provides instruction on EDR bypass methods grounded in documented techniques. The skill teaches endpoint detection response evasion through multiple approaches including custom payload compilation, AMSI bypass mechanisms, and ETW patching. All content is framed for authorized penetration testers conducting legitimate security research and red team exercises.
What tools and resources does Av Edr Evasion provide for security testing?
Av Edr Evasion equips security testers with resources for authorized testing, including compilation frameworks like mingw and Go for custom payloads, AMSI bypass techniques for PowerShell environments, and ETW patching methods. The skill stops before C2 setup or persistence, focusing on the evasion layer of penetration testing workflows.
Is Av Edr Evasion suitable for analyzing defensive security gaps?
Yes, Av Edr Evasion helps security professionals understand endpoint detection and response bypass methods to identify defensive gaps. By learning how evasion techniques work, defenders can improve their detection capabilities and strengthen their security posture against these documented attack vectors.
What licensing applies to Av Edr Evasion?
Av Edr Evasion is released under GPL-3.0 licensing, ensuring the skill and its materials remain open and freely available for authorized security research and testing purposes.