windows-mitigations-bypass
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Windows Mitigations & Bypass helps you defeat exploit protections like ASLR, DEP, CFG, and CET to execute memory-corruption attacks.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Windows Mitigations & Bypass helps you defeat exploit protections like ASLR, DEP, CFG, and CET to execute memory-corruption attacks. This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Use it when
- windows-mitigations-bypass documents evasion techniques for WDAC (Windows Defender Application Control), ASR (Attack Surface Reduction).
- Yes.
Verify before relying
Read SKILL.md below before installing (13 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/windows-mitigations · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is windows-mitigations-bypass and what does it cover?
windows-mitigations-bypass is an MIT-licensed skill that maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening.
How to bypass windows security controls WDAC ASR and related defenses?
windows-mitigations-bypass documents evasion techniques for WDAC (Windows Defender Application Control), ASR (Attack Surface Reduction), AMSI (Antimalware Scan Interface), and ETW (Event Tracing for Windows). The skill includes reconnaissance scripts and operational security guidance for each control, enabling testers to understand bypass vectors while defenders can harden their configurations.
Can windows-mitigations-bypass help fingerprint target system mitigations?
Yes. windows-mitigations-bypass includes a quick-start workflow and reconnaissance scripts for fingerprinting a target's mitigation landscape before weaponizing an exploit. This reconnaissance capability lets operators evaluate BYOVD/kernel versus userland attack paths based on VBS and HVCI state before committing to an exploitation strategy.
What memory-corruption exploit techniques does this skill address?
windows-mitigations-bypass covers bypass methods for ASLR, DEP, CFG, CET, ACG, and CIG protections. It includes ROP gadget finders and shadow stack evasion techniques, along with detection signatures for each bypass, enabling both red-team exploit development and blue-team defensive hardening.
Does windows-mitigations-bypass cover PPL and LSASS protection bypass?
Yes. windows-mitigations-bypass documents techniques for dumping protected processes like LSASS and killing PPL-protected security software, paired with detection signatures and operational security notes to help both offensive testers and defenders understand the attack surface.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: windows-mitigations-bypass description: Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI metadata: type: offensive phase: exploitation tools: [WinDbg, IDA, x64dbg, Process Hacker, ROPgadget, mona.py, PPLmedic, nanodump, EDRSandblast] mitre: [T1211, T1218, T1562.001, T1562.004, T1562.006, T1003.001, T1068, T1620, T1140] kill_chain: phase: [exploit, installation] step: [4, 5] attck_tactics: [TA0002, TA0004, TA0005] attck_techniques: [T1211, T1218, T1562.001, T1562.004, T1562.006, T1003.001, T1068, T1620, T1112] depends_on: [exploit-development, reverse-engineering] feeds_into: [shellcode-dev, edr-evasion, windows-boundaries] inputs: [mitigation_config, binary_analysis, target_os_build] outputs: [bypass_technique, finding_record, mitigation_fingerprint] references: - references/memory-safety-mitigations.md - references/acg-cig-dynamic-code.md - references/wdac-app-control-bypass.md - references/asr-amsi-etw-blinding.md - references/ppl-lsa-protection.md - references/byovd-vbs-hvci.md scripts: - scripts/mitigation_recon.ps1 -
(truncated - see the full file via the links below)
File tree — 13 files
skills/windows-mitigations/SKILL.md
skills/windows-mitigations/references/acg-cig-dynamic-code.md
skills/windows-mitigations/references/asr-amsi-etw-blinding.md
skills/windows-mitigations/references/byovd-vbs-hvci.md
skills/windows-mitigations/references/memory-safety-mitigations.md
skills/windows-mitigations/references/ppl-lsa-protection.md
skills/windows-mitigations/references/wdac-app-control-bypass.md
skills/windows-mitigations/scripts/Get-ProcessMitigationMap.ps1
skills/windows-mitigations/scripts/cfg_dispatch_gadget_finder.py
skills/windows-mitigations/scripts/check_driver_blocklist.py
skills/windows-mitigations/scripts/extract_asr_exclusions.py
skills/windows-mitigations/scripts/find_nonaslr_modules.py
skills/windows-mitigations/scripts/mitigation_recon.ps1
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Bypass Windows exploit mitigations (ASLR/DEP/CFG/CET) for memory-corruption attacks”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
This skill teaches authorized penetration testers how to evade antivirus and EDR systems blocking payload execution. It covers custom DLL and EXE compilation using mingw and Go, AMSI bypass for PowerShell, shellcode alternatives, and ETW patching—all grounded in documented techniques and stopping before C2 setup or persistence.
Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
Cloud Security targets identity and access control weaknesses across major cloud platforms. It covers IAM privilege escalation, credential harvesting via metadata SSRF, Entra device-code attacks, GCP service-account impersonation chains, Kubernetes container breakout, and CI/CD federation trust abuse. Includes scripts and references for reconnaissance, exploitation, and lateral movement within cloud environments.
Explore Windows kernel internals essential for security research, covering critical structures like EPROCESS and ETHREAD, callback systems, and enforcement mechanisms including PatchGuard, Driver Signature Enforcement, and Hypervisor-Enforced Code Integrity. Learn symbol resolution techniques, driver development patterns, and how anti-cheat systems detect kernel tampering.
More skills privesc-windows (MIT) · edr-evasion (MIT) · malware-analysis (MIT) · browser-exploitation (MIT) · mobile-pentest (MIT) · exploit-development (MIT) · awesome-game-security-overview (MIT) · kernel-security (MIT)