domains / families / security / windows-av-evasion

windows-av-evasion

separate

AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.

When to use

• bypassing AMSI
• ETW bypass
• .NET assembly detection evasion
• shellcode execution
• process injection
• API hooking evasion
• signature-based detection evasion

When not to use

• non-binary AD attacks
• lateral movement tools
• privesc tools

Skill page

Source