offensive-edr-evasion

Name: offensive-edr-evasion
Author: SnailSploit

2.8kstars447forks

How to install offensive-edr-evasion?

snailsploit/claude-red/offensive-edr-evasion

$npx -y skills add SnailSploit/Claude-Red --skill offensive-edr-evasion

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Endpoint Detection and Response
2
3	## Metadata
4	- Skill Name: edr-evasion
5	- Folder: offensive-edr-evasion
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/edr.md
7
8	## Description
9	EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`EDR evasion, EDR bypass, hook unhooking, direct syscalls, PPID spoofing, process injection, AMSI bypass, ETW patch, memory encryption, AV evasion, behavioral evasion, red team evasion`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Endpoint Detection and Response
29
30	## Fundamentals
31
32	### AV vs EDR
33
34	Antivirus (preventive approach):
35
36	- Static Analysis: Matching known signatures in files
37	- Dynamic Analysis: Limited behavioral monitoring/sandboxing
38	- Effective against known threats, weaker against advanced attacks
39
40	EDR (proactive & investigative approach):
41
42	- Continuous endpoint monitoring
43	- Behavioral analysis at kernel level
44	- Anomaly detection and post-compromise visibility
45	- Prioritizes incident response and investigation
46
47	### Windows Execution Flow
48
49	Windows program execution follows a hierarchical flow:
50
51	1. Applications - User programs like firefox.exe
52	2. DLLs - Libraries providing Windows functionality without direct low-level access
53	3. Kernel32.dll - Core DLL for memory management, process/thread creation
54	4. Ntdll.dll - Lowest user-mode DLL that exposes the NT API interface to the kernel
55	5. Kernel - Core OS component with unrestricted hardware access
56
57	Example operation flow (creating a file):
58
59	1. Application invokes `CreateFile` function
60	2. CreateFile forwards to `NtCreateFile`
61	3. Ntdll.dll triggers `NtCreateFile` syscall
62	4. Kernel creates the file and returns a handle
63
64	## EDR Visibility
65
66	### EDR Architecture & Components
67
68	EDR solutions consist of multiple components creating a complex attack surface:
69
70	Client-Side Components:
71
72	- User-space Applications - Main agent processes and UI components
73	- Kernel-space Drivers - Filter drivers, network drivers, software drivers
74	- Communication Interfaces - IOCTLs, FilterConnectionPorts, ALPC, Named Pipes
75
76	Component Communication Methods:
77
78	- Kernel-to-Kernel: Exported functions, IOCTLs
79	- User-to-Kernel: IOCTLs, FilterConnectionPorts (minifilter-specific), ALPC
80	- User-to-User: ALPC, Named Pipes, Files, Registry
81
82	Server-Side Components:
83
84	- Cloud services and management consoles
85	- On-premise servers (some vendors)
86	- Custom protocols for agent-to-cloud communication
87
88	### EDR Visibility Methods
89
90	EDR solutions require extended visibility into system activities:
91
92	- Filesystem monitoring via mini-filter drivers
93	- Process/module loading via image load kernel callbacks
94	- Process/.NET modules/Registry/kernel object events via ETW Ti
95	- Network monitoring via NDIS and network filtering drivers
96
97	### Static Analysis
98
99	- Extract information from binary
100	- Known malicious strings
101	- Threat actor IP or domains
102	- Malware binary hashes
103
104	### Dynamic Analysis
105
106	- Execute binary in a sandbox environment and observe it
107	- Network connections
108	- Registry changes
109	- Memory access
110	- File creation/deletion
111	- AntiMalware Scan Interface
112
113	### Behavioral Analysis
114
115	- Observe the binary as its executing, Hook into functions/syscalls
116	- User actions
117	- System calls
118	- Kernel callbacks
119	- Commands executed in the command line
120	- Which process is executing the code
121	- Event Tracing for Windows
122
123	## Detection Methods
124
125	### AV Signature Scanning
126
127	- Scans files using known signatures (YARA rules)
128	- Typically targets loaders and droppers
129	- Primarily static analysis of files on disk
130
131	### AV Emulation
132
133	- Runs suspicious programs in a simulated environment
134	- Triggers on behaviors without executing real code
135	- Used to detect obfuscated malware
136
137	### Usermode Hooks
138
139	- EDR hooks critical API calls in userspace (ntdll.dll)
140	- Monitors process creation, memory allocations, and network operations
141	- Allows for inspection before execution continues
142
143	### Kernel Telemetry
144
145	- Monitors events directly from the kernel
146	- Captures file, registry, process, and network operations
147	- Difficult to bypass as it operates at a lower level
148
149	### Memory Scanning
150
151	- Scans process memory for known signatures
152	- Triggers based on suspicious behavior
153	- Looks for shellcode, encryption, malicious strings
154	- Modern Context:
155	- Attackers also scan process memo

People who liked this also viewed

6 picks

Type

offensive-edr-evasion

2.8kstars447forks

View on GitHub

How to install offensive-edr-evasion?

snailsploit/claude-red/offensive-edr-evasion

$npx -y skills add SnailSploit/Claude-Red --skill offensive-edr-evasion

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Endpoint Detection and Response
2
3	## Metadata
4	- Skill Name: edr-evasion
5	- Folder: offensive-edr-evasion
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/edr.md
7
8	## Description
9	EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`EDR evasion, EDR bypass, hook unhooking, direct syscalls, PPID spoofing, process injection, AMSI bypass, ETW patch, memory encryption, AV evasion, behavioral evasion, red team evasion`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Endpoint Detection and Response
29
30	## Fundamentals
31
32	### AV vs EDR
33
34	Antivirus (preventive approach):
35
36	- Static Analysis: Matching known signatures in files
37	- Dynamic Analysis: Limited behavioral monitoring/sandboxing
38	- Effective against known threats, weaker against advanced attacks
39
40	EDR (proactive & investigative approach):
41
42	- Continuous endpoint monitoring
43	- Behavioral analysis at kernel level
44	- Anomaly detection and post-compromise visibility
45	- Prioritizes incident response and investigation
46
47	### Windows Execution Flow
48
49	Windows program execution follows a hierarchical flow:
50
51	1. Applications - User programs like firefox.exe
52	2. DLLs - Libraries providing Windows functionality without direct low-level access
53	3. Kernel32.dll - Core DLL for memory management, process/thread creation
54	4. Ntdll.dll - Lowest user-mode DLL that exposes the NT API interface to the kernel
55	5. Kernel - Core OS component with unrestricted hardware access
56
57	Example operation flow (creating a file):
58
59	1. Application invokes `CreateFile` function
60	2. CreateFile forwards to `NtCreateFile`
61	3. Ntdll.dll triggers `NtCreateFile` syscall
62	4. Kernel creates the file and returns a handle
63
64	## EDR Visibility
65
66	### EDR Architecture & Components
67
68	EDR solutions consist of multiple components creating a complex attack surface:
69
70	Client-Side Components:
71
72	- User-space Applications - Main agent processes and UI components
73	- Kernel-space Drivers - Filter drivers, network drivers, software drivers
74	- Communication Interfaces - IOCTLs, FilterConnectionPorts, ALPC, Named Pipes
75
76	Component Communication Methods:
77
78	- Kernel-to-Kernel: Exported functions, IOCTLs
79	- User-to-Kernel: IOCTLs, FilterConnectionPorts (minifilter-specific), ALPC
80	- User-to-User: ALPC, Named Pipes, Files, Registry
81
82	Server-Side Components:
83
84	- Cloud services and management consoles
85	- On-premise servers (some vendors)
86	- Custom protocols for agent-to-cloud communication
87
88	### EDR Visibility Methods
89
90	EDR solutions require extended visibility into system activities:
91
92	- Filesystem monitoring via mini-filter drivers
93	- Process/module loading via image load kernel callbacks
94	- Process/.NET modules/Registry/kernel object events via ETW Ti
95	- Network monitoring via NDIS and network filtering drivers
96
97	### Static Analysis
98
99	- Extract information from binary
100	- Known malicious strings
101	- Threat actor IP or domains
102	- Malware binary hashes
103
104	### Dynamic Analysis
105
106	- Execute binary in a sandbox environment and observe it
107	- Network connections
108	- Registry changes
109	- Memory access
110	- File creation/deletion
111	- AntiMalware Scan Interface
112
113	### Behavioral Analysis
114
115	- Observe the binary as its executing, Hook into functions/syscalls
116	- User actions
117	- System calls
118	- Kernel callbacks
119	- Commands executed in the command line
120	- Which process is executing the code
121	- Event Tracing for Windows
122
123	## Detection Methods
124
125	### AV Signature Scanning
126
127	- Scans files using known signatures (YARA rules)
128	- Typically targets loaders and droppers
129	- Primarily static analysis of files on disk
130
131	### AV Emulation
132
133	- Runs suspicious programs in a simulated environment
134	- Triggers on behaviors without executing real code
135	- Used to detect obfuscated malware
136
137	### Usermode Hooks
138
139	- EDR hooks critical API calls in userspace (ntdll.dll)
140	- Monitors process creation, memory allocations, and network operations
141	- Allows for inspection before execution continues
142
143	### Kernel Telemetry
144
145	- Monitors events directly from the kernel
146	- Captures file, registry, process, and network operations
147	- Difficult to bypass as it operates at a lower level
148
149	### Memory Scanning
150
151	- Scans process memory for known signatures
152	- Triggers based on suspicious behavior
153	- Looks for shellcode, encryption, malicious strings
154	- Modern Context:
155	- Attackers also scan process memo

People who liked this also viewed

6 picks

Type