defensive-edr-evasion

What problem does it solve?

EDR evasion detection and threat-hunting guidance to identify and respond to anti-forensic techniques used by attackers, including PPID spoofing, AMSI bypass, and process-injection artifacts.

Core Features & Use Cases

• EDR evasion indicators: PPID spoofing, AMSI patches, direct syscall patterns, reflective DLL artifacts, ETW patch detection.
• SOC triage guidance: detection rules and KQL queries for MDE process injection and AMSI events.
• Use Case: When investigating suspicious PowerShell or CreateRemoteThread activities, apply this skill to surface relevant signals and triage steps.

Quick Start

Run the SOC triage workflow to identify AMSI patches and PPID spoofing signals in PowerShell and process-injection events.