Menu

Individual skill

reverse-eng-edr-analysis

0upvotes

Reverse engineer the EDR/AV on an authorized target host, then evade it — fingerprint the product, dump its userland hook table, and assemble a matching bypass stack: ntdll unhooking, direct/indirect syscalls (Hell's/Halo's/Tartarus Gate), ETW and AMSI patching, hardware-breakpoint Blindside, call-stack spoofing, PPID spoof, sleep masks. Load for "bypass EDR", implant OPSEC against CrowdStrike/Defender/SentinelOne, or when telemetry keeps killing your payload. Signals: unhook, direct syscall, ETW patch, AMSI patch, ETW-TI, Sysmon evasion, MITRE T1562. Pentest only.

skills/reverse-engineering/reverse-eng-edr-analysis/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
27
Repository last updated
Oct 14, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# EDR analysis & evasion (red team)

## When it applies
An authorized red-team / adversary-emulation engagement requires an implant to survive on a host
running a modern EDR, or you're evaluating an EDR's detection coverage against your own
environment. Confirm the engagement covers defense evasion in writing first (`tradecraft-scope-roe`
+ `scope.txt`) — this is pentest-only, never bug bounty. You need the EDR's internals understood
(`reverse-eng-binary-triage` on its DLLs) before you can evade them deliberately.

## Why it works
An EDR is not a black box: it watches four surfaces — userland `ntdll` inline hooks, kernel
callbacks (Ps/Cm/Ob routines), ETW telemetry (notably the Threat-Intelligence provider), and AMSI
scans — and every one of them can be reverse engineered with IDA/windbg and then neutralized with a
matching technique. No single bypass is enough (unhooking doesn't stop ETW; an AMSI patch doesn't
Back to top