windows-mitigations-bypass
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Windows Mitigations & Bypass helps you defeat exploit protections like ASLR, DEP, CFG, and CET to execute memory-corruption attacks.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/windows-mitigations · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/windows-mitigations ~/.claude/skills/windows-mitigationsnpx skillfed install hypnguyen1209/offensive-claude/windows-mitigationsFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is windows-mitigations-bypass and what does it cover?
windows-mitigations-bypass is an MIT-licensed skill that maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening.
How to bypass windows security controls WDAC ASR and related defenses?
windows-mitigations-bypass documents evasion techniques for WDAC (Windows Defender Application Control), ASR (Attack Surface Reduction), AMSI (Antimalware Scan Interface), and ETW (Event Tracing for Windows). The skill includes reconnaissance scripts and operational security guidance for each control, enabling testers to understand bypass vectors while defenders can harden their configurations.
Can windows-mitigations-bypass help fingerprint target system mitigations?
Yes. windows-mitigations-bypass includes a quick-start workflow and reconnaissance scripts for fingerprinting a target's mitigation landscape before weaponizing an exploit. This reconnaissance capability lets operators evaluate BYOVD/kernel versus userland attack paths based on VBS and HVCI state before committing to an exploitation strategy.
What memory-corruption exploit techniques does this skill address?
windows-mitigations-bypass covers bypass methods for ASLR, DEP, CFG, CET, ACG, and CIG protections. It includes ROP gadget finders and shadow stack evasion techniques, along with detection signatures for each bypass, enabling both red-team exploit development and blue-team defensive hardening.
Does windows-mitigations-bypass cover PPL and LSASS protection bypass?
Yes. windows-mitigations-bypass documents techniques for dumping protected processes like LSASS and killing PPL-protected security software, paired with detection signatures and operational security notes to help both offensive testers and defenders understand the attack surface.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: windows-mitigations-bypass description: Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI metadata: type: offensive phase: exploitation tools: [WinDbg, IDA, x64dbg, Process Hacker, ROPgadget, mona.py, PPLmedic, nanodump, EDRSandblast] mitre: [T1211, T1218, T1562.001, T1562.004, T1562.006, T1003.001, T1068, T1620, T1140] kill_chain: phase: [exploit, installation] step: [4, 5] attck_tactics: [TA0002, TA0004, TA0005] attck_techniques: [T1211, T1218, T1562.001, T1562.004, T1562.006, T1003.001, T1068, T1620, T1112] depends_on: [exploit-development, reverse-engineering] feeds_into: [shellcode-dev, edr-evasion, windows-boundaries] inputs: [mitigation_config, binary_analysis, target_os_build] outputs: [bypass_technique, finding_record, mitigation_fingerprint] references: - references/memory-safety-mitigations.md - references/acg-cig-dynamic-code.md - references/wdac-app-control-bypass.md - references/asr-amsi-etw-blinding.md - references/ppl-lsa-protection.md - references/byovd-vbs-hvci.md scripts: - scripts/mitigation_recon.ps1 -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 13 files
skills/windows-mitigations/SKILL.md
skills/windows-mitigations/references/acg-cig-dynamic-code.md
skills/windows-mitigations/references/asr-amsi-etw-blinding.md
skills/windows-mitigations/references/byovd-vbs-hvci.md
skills/windows-mitigations/references/memory-safety-mitigations.md
skills/windows-mitigations/references/ppl-lsa-protection.md
skills/windows-mitigations/references/wdac-app-control-bypass.md
skills/windows-mitigations/scripts/Get-ProcessMitigationMap.ps1
skills/windows-mitigations/scripts/cfg_dispatch_gadget_finder.py
skills/windows-mitigations/scripts/check_driver_blocklist.py
skills/windows-mitigations/scripts/extract_asr_exclusions.py
skills/windows-mitigations/scripts/find_nonaslr_modules.py
skills/windows-mitigations/scripts/mitigation_recon.ps1