skills.rest
SnailSploit
SnailSploitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

edr-evasion

Evade EDR systems using hook unhooking, direct syscalls, and AMSI bypass.

2.9k|469|Updated Mar 4, 2026
Search Tags:#security#bypass#red team#endpoint security#offensive security#edr evasion
One-click install
npx skills add https://github.com/SnailSploit/Claude-Red --skill edr-evasion
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: edr-evasion
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-edr-evasion
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill edr-evasion

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a comprehensive methodology for evading Endpoint Detection and Response (EDR) systems, crucial for red team operations and security research.

Core Features & Use Cases

  • Advanced Evasion Techniques: Covers hook unhooking, direct/indirect syscalls, process injection variants, AMSI bypass, and more.
  • Targeted Application: Ideal for red team engagements requiring stealthy access or for understanding EDR vulnerabilities.
  • Use Case: When conducting a penetration test, use this Skill to guide your approach to bypass the target's EDR and gain a foothold without detection.

Quick Start

Use the edr-evasion skill to explore techniques for bypassing EDR detection during a red team engagement.

Frequently Asked Questions about edr-evasion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What techniques are used for EDR evasion during red team operations?▼

EDR evasion techniques include hook unhooking, direct syscalls, process injection, AMSI bypass, and ETW patching to bypass Endpoint Detection and Response systems stealthily.

How do I bypass EDR detection using direct syscalls and process injection?▼

You can bypass EDR detection by applying the detailed offensive methodology covering direct syscalls and process injection variants to circumvent user-mode hooks and execute payloads stealthily.

Do I need to understand Windows internals to bypass AMSI and patch ETW?▼

Yes, effective implementation for bypassing AMSI and patching ETW requires a solid understanding of Windows internals and EDR architecture to manipulate underlying system processes.

What is the best way to approach endpoint security bypass for penetration testing?▼

The best approach for penetration testing is using a targeted methodology that unhook APIs and leverages indirect syscalls to establish a foothold without triggering endpoint security alerts.

When should I use hook unhooking over other offensive security evasion methods?▼

Hook unhooking should be used when you need to neutralize user-mode API hooks deployed by EDR solutions to restore native function execution before applying further evasion techniques.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl
2

windows-av-evasion

Implement Windows AV/EDR evasion workflows for AMSI bypass and ETW telemetry reduction.

Community
Advanced
AeonDaveAeonDave
15

lazagne

Extract saved passwords from browsers, mail clients, databases, Git, and WiFi.

Community
Intermediate
AeonDaveAeonDave
15

nim-shellcode-fluctuation

Encrypts in-memory shellcode with XOR or RC4 between C2 callbacks.

Community
Advanced
alicangnllalicangnll

iOS Exploit

Analyze and exploit iOS vulnerabilities in IPA and Mach-O binaries.

Community
Advanced