edr-evasion
EDR Evasion covers defensive bypass methods used in red team engagements, from userland hook removal and direct syscall execution to AMSI patching and memory encryption. Learn how EDRs monitor endpoints and the techniques—including PPID spoofing, process injection variants, and ETW patching—that evade their detection.
EDR Evasion teaches techniques for bypassing endpoint detection and response systems during offensive security operations.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
EDR Evasion teaches techniques for bypassing endpoint detection and response systems during offensive security operations. EDR Evasion covers defensive bypass methods used in red team engagements, from userland hook removal and direct syscall execution to AMSI patching and memory encryption. Learn how EDRs monitor endpoints and the techniques—including PPID spoofing, process injection variants, and ETW patching—that evade their detection.
Use it when
- edr-evasion addresses antivirus evasion through multiple layers: hook unhooking to bypass ntdll monitoring.
- edr-evasion covers multiple process injection variants including APC injection with early bird techniques.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/edr-evasion · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What EDR bypass techniques does edr-evasion cover?
edr-evasion teaches defensive bypass methods used in red team engagements, including userland hook removal, direct syscall execution, AMSI patching, and memory encryption. The skill explains how EDRs monitor endpoints and covers evasion techniques such as PPID spoofing, process injection variants, and ETW patching to help operators understand detection mechanisms and bypass strategies.
How to evade antivirus detection with edr-evasion?
edr-evasion addresses antivirus evasion through multiple layers: hook unhooking to bypass ntdll monitoring, direct and indirect syscall execution to avoid userland API hooks, AMSI bypass for PowerShell obfuscation, and memory encryption combined with sleep masking. The skill also covers behavioral evasion and sandbox detection techniques to help red teams deliver payloads that avoid signature and heuristic detection.
What process injection methods are covered in edr-evasion?
edr-evasion covers multiple process injection variants including APC injection with early bird techniques, thread pool injection into remote processes, phantom DLL hollowing, and module stomping for shellcode execution. These methods are designed to evade endpoint detection by executing code in legitimate processes while avoiding behavioral monitoring and memory scanning by EDR solutions.
Does edr-evasion explain hook unhooking and syscall obfuscation?
Yes. edr-evasion provides detailed coverage of hook unhooking techniques including ntdll fresh copy methods and direct versus indirect syscall execution on Windows. The skill explains syscall obfuscation approaches and stack spoofing to manipulate return addresses, helping red teamers bypass EDR hooks and execute system calls without triggering detection.
What advanced evasion tactics does edr-evasion teach?
edr-evasion covers advanced tactics including ETW patching for event tracing evasion, sleep masking with beacon encryption, PPID spoofing to spoof parent process IDs, kernel callback removal via BYOVD (Bring Your Own Vulnerable Driver), and Windows 11-specific EDR evasion methods. These techniques target both userland and kernel-level monitoring to achieve comprehensive endpoint evasion.
Is edr-evasion suitable for red team payload delivery?
edr-evasion is designed specifically for red team operations, focusing on evasive payload delivery methods. It teaches how to develop payloads that bypass endpoint detection through behavioral evasion, sandbox detection, memory encryption, and multiple injection techniques. The skill combines userland and kernel-level evasion strategies to help operators deliver implants that avoid EDR and antivirus detection.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
EDR Evasion
When to Activate
- Planning EDR bypass during red team engagements
- Researching AV/EDR evasion techniques
- Developing implants that must survive endpoint detection
- Testing detection capabilities of security products
Fundamentals
AV vs EDR
Antivirus (preventive): - Static analysis: matching known signatures in files - Dynamic analysis: limited behavioral monitoring/sandboxing - Effective against known threats, weaker against advanced attacks
EDR (proactive & investigative): - Continuous endpoint monitoring - Behavioral analysis at kernel
(truncated - see the full file via the links below)
File tree — 1 file
skills/edr-evasion/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn EDR/AV evasion techniques for red team operations”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms.
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
This skill teaches authorized penetration testers how to evade antivirus and EDR systems blocking payload execution. It covers custom DLL and EXE compilation using mingw and Go, AMSI bypass for PowerShell, shellcode alternatives, and ETW patching—all grounded in documented techniques and stopping before C2 setup or persistence.
Crypto-analysis evaluates cryptographic posture across TLS/SSL/SSH configurations, public-key implementations, and token schemes. It detects cipher downgrades, weak key generation, nonce reuse, AEAD misuse, and JWT algorithm confusion using integrated tools like testssl.sh, openssl, and hashcat. Use it to identify cryptographic flaws before attackers do.
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Explore Windows kernel internals essential for security research, covering critical structures like EPROCESS and ETHREAD, callback systems, and enforcement mechanisms including PatchGuard, Driver Signature Enforcement, and Hypervisor-Enforced Code Integrity. Learn symbol resolution techniques, driver development patterns, and how anti-cheat systems detect kernel tampering.
More skills incident-response (MIT) · browser-exploitation-v8 (MIT) · Windows Kernel Exploits (GPL-3.0) · malware-analysis (MIT)