Edr Evasion

This covers the full spectrum of endpoint detection evasion: unhooking ntdll to remove userland hooks, direct and indirect syscalls to bypass monitored APIs, PPID spoofing to blend into legitimate process trees, and patching AMSI and ETW to blind telemetry. The source material is thorough, with actual C and assembly snippets for techniques like mapping clean ntdll from KnownDlls, resolving syscall numbers with HellsGate, and implementing sleep masking to encrypt beacon memory during idle periods. Use this when you're developing implants that need to survive modern EDR or testing your own detection stack. The skill also covers process injection variants ranked by stealth level, from basic CreateRemoteThread to threadless injection that avoids spawning new threads entirely. One honest take: this is pure red team tradecraft, so context matters.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill edr-evasion --agent claude-code

Installs into .claude/skills of the current project.

Files

EDR Evasion

When to Activate

Planning EDR bypass during red team engagements
Researching AV/EDR evasion techniques
Developing implants that must survive endpoint detection
Testing detection capabilities of security products

Fundamentals

AV vs EDR

Antivirus (preventive):

Static analysis: matching known signatures in files
Dynamic analysis: limited behavioral monitoring/sandboxing
Effective against known threats, weaker against advanced attacks

EDR (proactive & investigative):

Continuous endpoint monitoring
Behavioral analysis at kernel level
Anomaly detection and post-compromise visibility
Prioritizes incident response and investigation

Windows Execution Flow

Application → DLL (kernel32/ntdll) → Syscall → Kernel (ntoskrnl)
                    ↑
              EDR hooks here
              (userland hooks in ntdll)