skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

windows-av-evasion

Implement Windows AV/EDR evasion workflows for AMSI bypass and ETW telemetry reduction.

2|Updated May 15, 2026
Search Tags:#windows#payload obfuscation#process injection#av evasion#edr bypass#amSI bypass#etw bypass
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill windows-av-evasion
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: windows-av-evasion
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/windows-av-evasion
Command: npx skills add https://github.com/lNwNl/Methodos --skill windows-av-evasion

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides an operational playbook for evading Windows AV/EDR detections during security testing by covering common telemetry, runtime scanning, and hooking patterns.

Core Features & Use Cases

  • AMSI bypass: Memory patching, reflection-based flags, string/trigger obfuscation, and PowerShell-specific bypass approaches to reduce AMSI-driven scanning impact.
  • ETW and telemetry reduction: Techniques to limit Event Tracing for Windows signals that security tools consume for detection.
  • Execution and stealth workflows: Guidance for in-memory .NET loading, shellcode execution methods, process injection options, unhooking/hardening against API hooks, and payload encryption/obfuscation.
  • Signature-focused evasion: String encryption, API hashing, and metadata reduction to reduce static signature matches across tool execution paths.
  • Use Case: When a protected endpoint blocks a planned red-team payload, you can select a bypass and execution chain that targets the specific detection layer (AMSI, ETW, ntdll hooks, or signature-based matches) while keeping the operational flow coherent.

Quick Start

Load this Skill and ask an AI to propose a Windows AV/EDR evasion plan for your specific scenario, including the bypass sequence and an execution technique matched to AMSI/ETW/hooking constraints.

Frequently Asked Questions about windows-av-evasion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass AMSI and ETW telemetry for Windows payload execution?▼

Bypassing AMSI and ETW telemetry involves memory patching, reflection-based flags, and telemetry reduction techniques to limit runtime scanning signals before executing in-memory .NET assemblies or shellcode. This Skill provides structured workflows for chaining these bypasses.

What's the best way to unhook ntdll for EDR evasion during process injection?▼

Unhooking ntdll for EDR evasion is best achieved by replacing the hooked library with a fresh copy from disk or using direct syscalls to restore original API functionality, allowing stealthy process injection and execution without triggering security tool hooks.

How does payload obfuscation help with Windows AV signature evasion?▼

Payload obfuscation aids Windows AV signature evasion by encrypting strings, hashing API resolutions, and reducing metadata to prevent static signature matches across common execution paths. This ensures the payload remains undetected during static analysis.

Can I use in-memory .NET assembly loading to avoid endpoint detection?▼

In-memory .NET assembly loading can avoid endpoint detection by executing payloads directly in memory without touching disk. This Skill guides selecting execution chains that combine assembly loading with AMSI bypass and ETW reduction to maintain stealth.

Why does my red-team payload get blocked by Windows AV despite obfuscation?▼

Payloads get blocked by Windows AV when obfuscation alone doesn't counter runtime hooks, AMSI scanning, or ETW telemetry. You need a coherent evasion chain that targets each detection layer, including unhooking via syscalls and patching telemetry sources.

When should I use direct syscalls versus fresh ntdll replacement for API hook resistance?▼

Use direct syscalls for lightweight API hook resistance by bypassing userland hooks entirely, while fresh ntdll replacement is better for restoring full library integrity. This Skill helps select the right unhooking strategy based on your specific EDR constraints.

Related Skills

Explore More Software Engineering Skills→
riparinoriparino
1

defensive-edr-evasion

Detect EDR evasion techniques and map findings to KQL detection patterns.

Community
Advanced
AeonDaveAeonDave
15

donut

Convert .NET assemblies and Win32 executables into position-independent shellcode.

Community
Intermediate
richardnguyen0715richardnguyen0715

scrapling

Scrape static and JavaScript-rendered web content with stealth and Cloudflare bypass.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

av-edr-evasion

Compile custom C and Go payloads to bypass antivirus and EDR detection.

Official
Advanced