edr-evasion
EDR Evasion covers defensive bypass methods used in red team engagements, from userland hook removal and direct syscall execution to AMSI patching and memory encryption. Learn how EDRs monitor endpoints and the techniques—including PPID spoofing, process injection variants, and ETW patching—that evade their detection.
EDR Evasion teaches techniques for bypassing endpoint detection and response systems during offensive security operations.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/edr-evasion · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/edr-evasion ~/.claude/skills/edr-evasionnpx skillfed install hypnguyen1209/offensive-claude/edr-evasionFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What EDR bypass techniques does edr-evasion cover?
edr-evasion teaches defensive bypass methods used in red team engagements, including userland hook removal, direct syscall execution, AMSI patching, and memory encryption. The skill explains how EDRs monitor endpoints and covers evasion techniques such as PPID spoofing, process injection variants, and ETW patching to help operators understand detection mechanisms and bypass strategies.
How to evade antivirus detection with edr-evasion?
edr-evasion addresses antivirus evasion through multiple layers: hook unhooking to bypass ntdll monitoring, direct and indirect syscall execution to avoid userland API hooks, AMSI bypass for PowerShell obfuscation, and memory encryption combined with sleep masking. The skill also covers behavioral evasion and sandbox detection techniques to help red teams deliver payloads that avoid signature and heuristic detection.
What process injection methods are covered in edr-evasion?
edr-evasion covers multiple process injection variants including APC injection with early bird techniques, thread pool injection into remote processes, phantom DLL hollowing, and module stomping for shellcode execution. These methods are designed to evade endpoint detection by executing code in legitimate processes while avoiding behavioral monitoring and memory scanning by EDR solutions.
Does edr-evasion explain hook unhooking and syscall obfuscation?
Yes. edr-evasion provides detailed coverage of hook unhooking techniques including ntdll fresh copy methods and direct versus indirect syscall execution on Windows. The skill explains syscall obfuscation approaches and stack spoofing to manipulate return addresses, helping red teamers bypass EDR hooks and execute system calls without triggering detection.
What advanced evasion tactics does edr-evasion teach?
edr-evasion covers advanced tactics including ETW patching for event tracing evasion, sleep masking with beacon encryption, PPID spoofing to spoof parent process IDs, kernel callback removal via BYOVD (Bring Your Own Vulnerable Driver), and Windows 11-specific EDR evasion methods. These techniques target both userland and kernel-level monitoring to achieve comprehensive endpoint evasion.
Is edr-evasion suitable for red team payload delivery?
edr-evasion is designed specifically for red team operations, focusing on evasive payload delivery methods. It teaches how to develop payloads that bypass endpoint detection through behavioral evasion, sandbox detection, memory encryption, and multiple injection techniques. The skill combines userland and kernel-level evasion strategies to help operators deliver implants that avoid EDR and antivirus detection.
SKILL.md
rendered from the published skill — quoted content, verbatim
EDR Evasion
When to Activate
- Planning EDR bypass during red team engagements
- Researching AV/EDR evasion techniques
- Developing implants that must survive endpoint detection
- Testing detection capabilities of security products
Fundamentals
AV vs EDR
Antivirus (preventive): - Static analysis: matching known signatures in files - Dynamic analysis: limited behavioral monitoring/sandboxing - Effective against known threats, weaker against advanced attacks
EDR (proactive & investigative): - Continuous endpoint monitoring - Behavioral analysis at kernel
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/edr-evasion/SKILL.md