skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-edr-evasion

Detect EDR evasion techniques and map findings to KQL detection patterns.

1|Updated Apr 27, 2026
Search Tags:#detection#kql#yara#amsi#edr-evasion#ppid-spoofing#etw
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-edr-evasion
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-edr-evasion
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-edr-evasion
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-edr-evasion

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

EDR evasion detection and threat-hunting guidance to identify and respond to anti-forensic techniques used by attackers, including PPID spoofing, AMSI bypass, and process-injection artifacts.

Core Features & Use Cases

  • EDR evasion indicators: PPID spoofing, AMSI patches, direct syscall patterns, reflective DLL artifacts, ETW patch detection.
  • SOC triage guidance: detection rules and KQL queries for MDE process injection and AMSI events.
  • Use Case: When investigating suspicious PowerShell or CreateRemoteThread activities, apply this skill to surface relevant signals and triage steps.

Quick Start

Run the SOC triage workflow to identify AMSI patches and PPID spoofing signals in PowerShell and process-injection events.

Frequently Asked Questions about defensive-edr-evasion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect AMSI bypass and PPID spoofing signals in Windows endpoint logs?▼

Detect AMSI bypass and PPID spoofing by running the SOC triage workflow to surface relevant signals in PowerShell and process-injection events, mapping findings to KQL patterns and YARA rules aligned with MITRE techniques.

What KQL queries help investigate CreateRemoteThread and process injection alerts in MDE?▼

KQL queries for MDE process injection and AMSI events map CreateRemoteThread and suspicious PowerShell activities to detection rules, providing triage steps to surface process-injection artifacts across Windows endpoints.

How does ETW patch detection work for threat hunting and SOC investigations?▼

ETW patch detection works by identifying direct syscall patterns and reflective DLL artifacts during threat hunting, mapping evasion techniques to detection rules for SOC and IR workflows across Windows endpoints.

Can I use this skill to triage SOC alerts for direct syscall and reflective DLL artifacts?▼

Yes, you can triage SOC alerts for direct syscall and reflective DLL artifacts by applying detection mappings that cover anti-forensic techniques, including AMSI patches, PPID spoofing, and ETW patches.

What is the best way to map EDR evasion techniques to MITRE detection rules?▼

Map EDR evasion techniques to MITRE detection rules by applying the skill's methodology to process-injection signals, generating KQL patterns and YARA rules that satisfy metadata requirements for SOC and IR workflows.

Why does my EDR evasion detection miss direct syscall patterns during incident response?▼

EDR evasion detection may miss direct syscall patterns if methodology lacks coverage for ETW patches and reflective DLL artifacts; applying comprehensive KQL patterns and YARA rules aligned to MITRE techniques improves visibility.

Related Skills

Explore More Data & Analytics Skills→
SnailSploitSnailSploit
2.9k

edr-evasion

Evade EDR systems using hook unhooking, direct syscalls, and AMSI bypass.

Community
Advanced
riparinoriparino
1

defensive-shellcode

Detect shellcode in memory using YARA rules and KQL telemetry.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
YukiIto1999YukiIto1999

performing-threat-hunting-with-yara-rules

Detect malware and indicators of compromise across filesystems and memory dumps with YARA rules.

Community
Advanced