Windows Av Evasion

This is a technical reference for bypassing Windows antivirus and EDR during security assessments. It covers AMSI and ETW patching, in-memory .NET assembly loading, shellcode execution via callback APIs, and process injection techniques ranging from the classic CreateRemoteThread to stealthier methods like Early Bird APC and transacted hollowing. The unhooking section is solid, walking through direct syscalls with SysWhispers, fresh ntdll copying, and indirect syscall patterns. You'd load this when your tooling is getting flagged and you need specific bypass chains. The skill pairs well with privilege escalation and lateral movement skills since those often trigger detections. It's dense and assumes you understand Windows internals, so this isn't a beginner resource.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill windows-av-evasion --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: AV/EDR Evasion — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection-specific bypass chains and syscall-level evasion nuances.