--- id: hypnguyen1209/offensive-claude/windows-mitigations version: "92e62cda" license: MIT install: manual updated: 2026-07-03 --- # windows-mitigations-bypass — This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit. Publisher: hypnguyen1209 · Stars: 326 · Updated: 2026-07-03 Install (manual): `git clone https://github.com/hypnguyen1209/offensive-claude` ## SKILL.md # Windows Mitigations & Bypass Defeating both **exploit mitigations** (ASLR/DEP/CFG/XFG/CET/ACG) and **platform security controls** (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement. ## When to Activate - Fingerprinting a target's mitigation landscape before weaponizing an exploit - Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain - Bypassing application control (WDAC / App Control for Business) to run unsigned code - Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation - Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR - Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module) | T1211 | CWE-330 | references/memory-safety-mitigations.md | scripts/find_nonaslr_modules.py | | DEP/NX bypass (ROP→VirtualProtect, ret2libc) | T1211 | CWE-119 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py | | CFG/XFG bypass (valid-target dispatch gadget, type-hash collision) | T1211 | CWE-1240 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py | | CET shadow stack / IBT evasion (non-CET process, JOP, exception unwind) | T1211 | CWE-1419 | references/memory-safety-mitigations.md | scripts/Get-ProcessMitigationMap.ps1 | | ACG/CIG bypass (signed-code reuse, JIT exemption, cross-process) | T1211, T1055 | CWE-94 | references/acg-cig-dynamic-code.md | scripts/Get-ProcessMitigationMap.ps1 | | WDAC / App Control bypass (LOLBin, signed Electron/V8, sideload) | T1218 | CWE-693 | references/wdac-app-control-bypass.md | scripts/mitigation_recon.ps1 | | ASR rule bypass (excluded path/process hollow, COM, syscalls) | T1562.001 | CWE-693 | references/asr-amsi-etw-blinding.md | scripts/extract_asr_exclusions.py | | AMSI bypass (amsiInitFailed, AmsiScanBuffer patch, hardware bp) | T1562.001 | CWE-693 | references/asr-amsi-etw-blinding.md | scripts/mitigation_recon.ps1 | | ETW blinding (EtwEventWrite patch, provider disable, NtTraceControl) | T1562.006 | CWE-778 | references/asr-amsi-etw-blinding.md | scripts/mitigation_recon.ps1 | | PPL / LSA Protection bypass (PPLmedic userland chain, BYOVD) | T1003.001, T1562.001 | CWE-269 | references/ppl-lsa-protection.md | scripts/Get-ProcessMitigationMap.ps1 | | BYOVD kernel R/W (unblocked driver, EPROCESS.Protection wipe) | T1068, T1562.001 | CWE-822 | references/byovd-vbs-hvci.md | scripts/check_driver_blocklist.py | | VBS/HVCI/Credential Guard evasion (blocklist evasion, data-only) | T1068, T1562.001 | CWE-693 | references/byovd-vbs-hvci.md | scripts/check_driver_blocklist.py | ## Quick Start ```powershell # 1. Fingerprint system + per-process mitigations, AMSI/ETW/ASR/WDAC/VBS state powershell -ep bypass -f scripts/mitigation_recon.ps1 -OutJson recon.json powershell -ep bypass -f scripts/Get-ProcessMitigationMap.ps1 # rank weak processes # 2. If memory-corruption target: locate non-ASLR modules + CFG-valid dispatch gadgets python scripts/find_nonaslr_modules.py C:\Target\*.dll python scripts/cfg_dispatch_gadget_finder.py target.dll # ROP/JOP under CFG/CET # 3. If application control (WDAC) blocks execution: pick a signed bypass vessel # MSBuild inline C#, signed legacy Teams (Electron), or signed Node .node module # 4. Blind telemetry before post-ex (use sparingly — patching is itself an IOC) # AMSI: patch AmsiScanBuffer / amsiInitFailed ETW: patch EtwEventWrite # 5. Credential access vs PPL/LSA: userland PPLmedic chain (no driver) or BYOVD python scripts/extract_asr_exclusions.py # find ASR-excluded paths python scripts/check_driver_blocklist.py mydriver.sys # is driver blocklisted/HVCI-safe? ``` ## OPSEC & Detection (summary) | Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note | |-----------|-----------------|--------------------------|------------| | ROP/JOP exploit | crash dumps, WER, #CP/#PF exceptions, RWX alloc | EDR stack-walk on VirtualProtect/VirtualAlloc; CFG/CET #CP telemetry | prefer data-only; reuse signed gadgets; avoid RWX | | WDAC LOLBin | 4688 w/ MSBuild/mshta parent, child of office/explorer | Sigma proc_creation_win_lolbin_*; CodeIntegrity 3076/3077 audit | use Microsoft-signed Electron/V8 — looks like normal app | | AMSI patch | RWX in amsi.dll, AMSI scan gaps | AMSI bypass detections, mem scan of amsi.dll .text | indirect syscalls; restore bytes; HWBP avoids byte edits | | ETW patch | EtwEventWrite first byte = 0xC3/0xCC | ETW-TI sensor; integrity scan of ntdll EtwEventWrite | restore after use; or disable provider not whole API | | PPL LSASS dump | handle to lsass w/ VM_READ, MiniDump call, 4656/4663 | Sysmon 10 GrantedAccess 0x1010/0x1410; Defender ASR 9e6c... | userland PPLmedic avoids driver IOC; rename per ASR excl. | | BYOVD | Sysmon 6 driver load, svc create reg, unsigned-by-MS driver | Sysmon EID6 + reg EID13; MDE LOLDrivers hash hunt; blocklist | pick driver NOT in MS blocklist/LOLDrivers; HVCI may still block | | VBS/HVCI off | bcdedit hypervisorlaunchtype off, DeviceGuard reg writes | reg EID13 on DeviceGuard; boot config change events | requires admin+reboot — loud; data-only attack instead | ## Deep Dives - **references/memory-safety-mitigations.md** — ASLR/HEASLR, DEP/NX, CFG/XFG, Intel CET shadow stack + IBT, SEHOP: how each works on Win11 24H2 and concrete bypass chains (info leak → dispatch gadget → VirtualProtect). - **references/acg-cig-dynamic-code.md** — Arbitrary Code Guard, Code Integrity Guard, Dynamic Code policy: signed-code-only reuse, JIT/browser exemptions, cross-process pivots, SEC_IMAGE section abuse. - **references/wdac-app-control-bypass.md** — WDAC / App Control for Business: recommended-block-rule LOLBins, signed Electron (Loki C2) + signed Node `.node`/V8 exploitation, DLL sideloading, allow-list reality check. - **references/asr-amsi-etw-blinding.md** — ASR rule bypasses (global exclusion abuse, process hollowing into trusted images), AMSI bypass variants, ETW blinding (full patch vs selective provider disable). - **references/ppl-lsa-protection.md** — PPL levels & LSA Protection (RunAsPPL), userland PPLmedic exploit chain, PPLBlade/nanodump dumping, Credential Guard reality, BYOVD PPL kill. - **references/byovd-vbs-hvci.md** — BYOVD kernel R/W primitive build, Microsoft driver blocklist + LOLDrivers + HVCI/Secure Boot evasion (Silver Fox amsdk.sys case), VBS/Credential Guard limits, kernel shadow stack. [View on SkillFed](https://skillfed.io/hypnguyen1209/offensive-claude/windows-mitigations) · [View on GitHub](https://github.com/hypnguyen1209/offensive-claude)