windows-mitigations
starsforks
How to install windows-mitigations?
hypnguyen1209/offensive-claude/windows-mitigations
$npx -y skills add hypnguyen1209/offensive-claude --skill windows-mitigationsUse when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI
SKILL.md
| 1 | # Windows Mitigations & Bypass |
| 2 | |
| 3 | Defeating both **exploit mitigations** (ASLR/DEP/CFG/XFG/CET/ACG) and **platform security controls** |
| 4 | (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + |
| 5 | OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement. |
| 6 | |
| 7 | ## When to Activate |
| 8 | |
| 9 | - Fingerprinting a target's mitigation landscape before weaponizing an exploit |
| 10 | - Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain |
| 11 | - Bypassing application control (WDAC / App Control for Business) to run unsigned code |
| 12 | - Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation |
| 13 | - Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR |
| 14 | - Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state |
| 15 | |
| 16 | ## Technique Map |
| 17 | |
| 18 | | Technique | ATT&CK | CWE | Reference | Script | |
| 19 | |-----------|--------|-----|-----------|--------| |
| 20 | | ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module) | T1211 | CWE-330 | references/memory-safety-mitigations.md | scripts/find_nonaslr_modules.py | |
| 21 | | DEP/NX bypass (ROP→VirtualProtect, ret2libc) | T1211 | CWE-119 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py | |
| 22 | | CFG/XFG bypass (valid-target dispatch gadget, type-hash collision) | T1211 | CWE-1240 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py | |
| 23 | | CET shadow stack / IBT evasion (non-CET process, JOP, exception unwind) | T1211 | CWE-1419 | references/memory-safety-mitigations.md | scripts/Get-ProcessMitigationMap.ps1 | |
| 24 | | ACG/CIG bypass (signed-code reuse, JIT exemption, cross-process) | T1211, T1055 | CWE-94 | references/acg-cig-dynamic-code.md | scripts/Get-ProcessMitigationMap.ps1 | |
| 25 | | WDAC / App Control bypass (LOLBin, signed Electron/V8, sideload) | T1218 | CWE-693 | references/wdac-app-control-bypass.md | scripts/mitigation_recon.ps1 | |
| 26 | | ASR rule bypass (excluded path/process hollow, COM, syscalls) | T1562.001 | CWE-693 | references/asr-amsi-etw-blinding.md | scripts/extract_asr_exclusions.py | |
| 27 | | AMSI bypass (amsiInitFailed, AmsiScanBuffer patch, hardware bp) | T1562.001 | CWE-693 | references/asr-amsi-etw-blinding.md | scripts/mitigation_recon.ps1 | |
| 28 | | ETW blinding (EtwEventWrite patch, provider disable, NtTraceControl) | T1562.006 | CWE-778 | references/asr-amsi-etw-blinding.md | scripts/mitigation_recon.ps1 | |
| 29 | | PPL / LSA Protection bypass (PPLmedic userland chain, BYOVD) | T1003.001, T1562.001 | CWE-269 | references/ppl-lsa-protection.md | scripts/Get-ProcessMitigationMap.ps1 | |
| 30 | | BYOVD kernel R/W (unblocked driver, EPROCESS.Protection wipe) | T1068, T1562.001 | CWE-822 | references/byovd-vbs-hvci.md | scripts/check_driver_blocklist.py | |
| 31 | | VBS/HVCI/Credential Guard evasion (blocklist evasion, data-only) | T1068, T1562.001 | CWE-693 | references/byovd-vbs-hvci.md | scripts/check_driver_blocklist.py | |
| 32 | |
| 33 | ## Quick Start |
| 34 | |
| 35 | ```powershell |
| 36 | # 1. Fingerprint system + per-process mitigations, AMSI/ETW/ASR/WDAC/VBS state |
| 37 | powershell -ep bypass -f scripts/mitigation_recon.ps1 -OutJson recon.json |
| 38 | powershell -ep bypass -f scripts/Get-ProcessMitigationMap.ps1 # rank weak processes |
| 39 | |
| 40 | # 2. If memory-corruption target: locate non-ASLR modules + CFG-valid dispatch gadgets |
| 41 | python scripts/find_nonaslr_modules.py C:\Target\*.dll |
| 42 | python scripts/cfg_dispatch_gadget_finder.py target.dll # ROP/JOP under CFG/CET |
| 43 | |
| 44 | # 3. If application control (WDAC) blocks execution: pick a signed bypass vessel |
| 45 | # MSBuild inline C#, signed legacy Teams (Electron), or signed Node .node module |
| 46 | |
| 47 | # 4. Blind telemetry be |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
