Windows Mitigations

This is a bypass encyclopedia for Windows exploit mitigations, covering everything from ASLR and DEP to newer stuff like CFG, CET shadow stacks, and WDAC. You get fingerprinting commands to identify what's protecting a target, then concrete bypass techniques for each layer: ROP chains for DEP, partial overwrites for ASLR, COOP for CFG, LOLBins for application control. The WDAC and ASR sections are especially practical with actual command examples (MSBuild, regsvr32 scriptlets). It also covers defensive evasion like ETW blinding and PPL bypass via vulnerable drivers. Use this when you need to understand the mitigation stack on a target and plan your exploitation path. More reference material than step-by-step automation, but that's what you want for this domain.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill windows-mitigations --agent claude-code

Installs into .claude/skills of the current project.

Files

Windows Mitigations & Bypass

Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement.

When to Activate

Fingerprinting a target's mitigation landscape before weaponizing an exploit
Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain
Bypassing application control (WDAC / App Control for Business) to run unsigned code
Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation
Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR
Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state