windows-av-evasion
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems. It covers AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
Windows AV/EDR Evasion provides attack playbook techniques for bypassing antivirus and EDR detection on Windows systems.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/windows-av-evasion · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/windows-av-evasion ~/.claude/skills/windows-av-evasionnpx skillfed install yaklang/hack-skills/windows-av-evasionFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What windows av evasion techniques does this skill cover?
Windows AV/EDR Evasion teaches hands-on bypass techniques for antivirus and endpoint detection systems, including AMSI memory patching, ETW disabling, .NET assembly loading, shellcode execution via callbacks, process injection methods, EDR unhooking with syscalls, and payload encryption to evade signature-based detection.
How can I bypass AMSI and ETW on Windows systems?
Windows AV/EDR Evasion covers AMSI bypass through memory patching techniques and ETW disabling methods. The skill teaches how to patch AMSI in memory to prevent script scanning and disable Event Tracing for Windows to avoid behavioral detection during attack operations.
What shellcode execution methods are included?
Windows AV/EDR Evasion covers shellcode execution via callbacks, process injection techniques including process hollowing and early bird APC injection, and module stomping. These methods allow payload delivery while evading signature-based and behavioral detection mechanisms.
How does Windows AV/EDR Evasion address EDR detection?
Windows AV/EDR Evasion teaches EDR unhooking with direct syscalls and NTDLL unhooking techniques to bypass endpoint detection and response systems. It covers syscall-level evasion to avoid EDR hooking mechanisms that monitor system calls.
What payload obfuscation methods are taught?
Windows AV/EDR Evasion covers payload encryption and obfuscation to evade signature-based detection. The skill teaches how to encrypt payloads so they bypass antivirus signature scanning and behavioral analysis.
Does this skill cover constrained language mode bypass?
Windows AV/EDR Evasion includes constrained language mode bypass techniques alongside .NET assembly loading methods, enabling unrestricted code execution in restricted PowerShell environments while maintaining evasion from detection systems.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: AV/EDR Evasion — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection-specific bypass chains and syscall-level evasion nuances.
0. RELATED ROUTING
Before going deep, consider loading:
- windows-privilege-escalation when privesc tools are blocked by AV
- windows-lateral-movement when lateral movement tools trigger EDR
- active-directory-kerberos-attacks when Rubeus/Mimikatz are detected
- active-directory-acl-abuse for non-binary AD attacks (less AV-sensitive)
Advanced Reference
Also load
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/windows-av-evasion/AMSI_BYPASS_TECHNIQUES.md
skills/windows-av-evasion/SKILL.md