AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.

SKILL: AV/EDR Evasion — Expert Attack Playbook AI LOAD INSTRUCTION : Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection specific bypass chains and syscall level evasion nuances. 0. RELATED ROUTING Before going deep, consider loading: [windows privilege escalation](../windows privilege escalation/SKILL.md) when privesc tools are blocked by AV [windows lateral movement](../windows lateral movement/SKILL.md) when lateral movement tools trigger EDR [active directory kerberos attacks](../active directory kerberos attacks/SKILL.md) when Rubeus/Mimikatz are detected [active directory acl abuse](../active directory acl abuse/SKILL.md) for non binary AD attacks (less AV sensitive) Advanced Reference Also load [AMSI BYPASS TECHNIQUES.md](./AMSI BYPASS TECHNIQUES.md) when you need: Detailed AMSI bypass code patterns (memory patching, reflection) PowerShell specific AMSI bypasses .NET AMSI bypass techniques 1. AMSI BYPASS OVERVIEW AMSI (Antimalware Scan Interface) inspects PowerShell, .NET, VBScript, JScript, and Office macros at runtime. Key AMSI Bypass Categories Category Method Detection Risk Persistence Memory patching Patch AmsiScanBuffer in amsi.dll Medium Per process Reflection Modify AMSI init flags via .NET reflection Medium Per session String obfuscation Encode/split AMSI trigger strings Low Per payload PowerShell downgrade Force PS v2 (no AMSI) Low Per session CLM bypass Escape Constrained Language Mode Medium Per session COM hijack Redirect AMSI COM server Low Per user Quick AMSI Bypass (One Liners) 2. ETW BYPASS ETW (Event Tracing for Windows) feeds telemetry to EDR. Patching EtwEventWrite stops .NET assembly load events. Patch EtwEventWrite PowerShell ETW Bypass 3. .NET ASSEMBLY LOADING In Memory Assembly.Load Donut — Convert .NET Assembly to Shellcode execute assembly (C2 Framework) 4. SHELLCODE EXECUTION TECHNIQUES VirtualAlloc + Callback (Avoids CreateThread) Callback APIs for shellcode execution : EnumWindows , EnumChildWindows , EnumFonts , EnumDesktops , CertEnumSystemStore , EnumDateFormats — all accept function pointers that can point to shellcode. 5. PROCESS INJECTION TECHNIQUES Technique APIs Used Detection Risk Notes CreateRemoteThread OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread High Classic, heavily monitored NtMapViewOfSection NtCreateSection, NtMapViewOfSection Medium Shared memory, less common Process Hollowing CreateProcess (SUSPENDED), NtUnmapViewOfSection, WriteProcessMemory, ResumeThread Medium Replace process image Thread Hijacking SuspendThread, SetThreadContext, ResumeThread Medium Modify existing thread Early Bird CreateProcess (SUSPENDED), QueueUserAPC, ResumeThread Low Medium APC before main thread Phantom DLL Hollowing Map DLL section, overwrite with shellcode Low Uses legitimate DLL mapping Module Stomping LoadLibrary, overwrite .text section Low Backed by legitimate DLL Transacted Hollowing NtCreateTransaction, NtCreateSection Low No suspicious allocations CreateRemoteThread (Basic Pattern) Early Bird APC Injection 6. UNHOOKING — BYPASS EDR API HOOKS Direct Syscalls (SysWhispers / HellsGate) EDR hooks ntdll.dll functions. Direct syscalls bypass hooks by invoking the kernel directly. Tool Method Notes SysWhispers2/3 Compile time syscall stubs Static syscall numbers HellsGate Runtime syscall number resolution Dynamic, harder to detect HalosGate Resolve from neighboring unhooked syscalls Handles partial hooks TartarusGate Extended HalosGate More robust resolution Fresh ntdll Copy Indirect Syscalls 7. PAYLOAD ENCRYPTION & OBFUSCATION Encryption Methods Sleep Obfuscation Encrypt shellcode in memory during sleep to avoid memory scanners. Technique Method Ekko ROP chain → encrypt heap/stack during sleep Foliage APC based sleep with memory encryption DeathSleep Thread de registration during sleep Staged Loading 8. SIGNATURE EVASION String Encryption API Hashing Metadata Removal C2 Framework Evasion Framework Key Evasion Features Cobalt Strike Malleable C2 profiles, HTTP/S traffic shaping, sleep jitter, PE evasion Sliver Multiple protocols (mTLS, WireGuard, DNS), stager less, built in obfuscation Havoc Indirect syscalls, sleep obfuscation, module stomping Brute Ratel Badger agent, syscall evasion, ETW/AMSI bypass built in 9. AV/EDR EVASION DECISION TREE

windows-av-evasion