windows-av-evasion
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
Windows AV/EDR Evasion provides attack playbook techniques for bypassing antivirus and EDR detection on Windows systems.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Windows AV/EDR Evasion provides attack playbook techniques for bypassing antivirus and EDR detection on Windows systems. Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
Use it when
- Windows AV/EDR Evasion covers AMSI bypass through memory patching techniques and ETW disabling methods.
- Windows AV/EDR Evasion covers shellcode execution via callbacks.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/windows-av-evasion · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What windows av evasion techniques does this skill cover?
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems, including AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
How can I bypass AMSI and ETW on Windows systems?
Windows AV/EDR Evasion covers AMSI bypass through memory patching techniques and ETW disabling methods. The skill teaches how to patch AMSI in memory to prevent script scanning and disable Event Tracing for Windows to avoid behavioral detection during attack operations.
What shellcode execution methods are included?
Windows AV/EDR Evasion covers shellcode execution via callbacks, process injection techniques including process hollowing and early bird APC injection, and module stomping. These methods allow payload delivery while evading signature-based and behavioral detection mechanisms.
How does Windows AV/EDR Evasion address EDR detection?
Windows AV/EDR Evasion teaches EDR unhooking with direct syscalls and NTDLL unhooking techniques to bypass endpoint detection and response systems. It covers syscall-level evasion to avoid EDR hooking mechanisms that monitor system calls.
What payload obfuscation methods are taught?
Windows AV/EDR Evasion covers payload encryption and obfuscation to evade signature-based detection. The skill teaches how to encrypt payloads so they bypass antivirus signature scanning and behavioral analysis.
Does this skill cover constrained language mode bypass?
Windows AV/EDR Evasion includes constrained language mode bypass techniques alongside .NET assembly loading methods, enabling unrestricted code execution in restricted PowerShell environments while maintaining evasion from detection systems.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: AV/EDR Evasion — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection-specific bypass chains and syscall-level evasion nuances.
0. RELATED ROUTING
Before going deep, consider loading:
- windows-privilege-escalation when privesc tools are blocked by AV
- windows-lateral-movement when lateral movement tools trigger EDR
- active-directory-kerberos-attacks when Rubeus/Mimikatz are detected
- active-directory-acl-abuse for non-binary AD attacks (less AV-sensitive)
Advanced Reference
Also load
(truncated - see the full file via the links below)
File tree — 2 files
skills/windows-av-evasion/AMSI_BYPASS_TECHNIQUES.md
skills/windows-av-evasion/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn AV/EDR evasion techniques for Windows attack operations”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill teaches authorized penetration testers how to evade antivirus and EDR systems blocking payload execution. It covers custom DLL and EXE compilation using mingw and Go, AMSI bypass for PowerShell, shellcode alternatives, and ETW patching—all grounded in documented techniques and stopping before C2 setup or persistence.
EDR Evasion covers defensive bypass methods used in red team engagements, from userland hook removal and direct syscall execution to AMSI patching and memory encryption. Learn how EDRs monitor endpoints and the techniques—including PPID spoofing, process injection variants, and ETW patching—that evade their detection.
ctf-malware equips you with techniques for dissecting malware in CTF competitions, covering obfuscated scripts, binary analysis, network traffic decryption, and evasion detection. It guides you through static analysis with tools like YARA and Capstone, dynamic analysis with strace and ltrace, and memory forensics with Volatility, plus custom crypto protocol identification and malware configuration extraction.
Shellcode-dev guides you through building position-independent code for implant delivery, covering PEB walking for API resolution, ROR13 hashing, and null-byte elimination. It includes loader patterns, PE conversion tools, and evasion strategies for bypassing static detection across Windows, Linux, and macOS platforms.
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings.
More skills threat-hunting (MIT) · Bitdefender Security Analysis (NOASSERTION)