skills.rest
SnailSploit
SnailSploitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

windows-boundaries

Analyze Windows security mitigations and bypass techniques for offensive operations.

2.9k|469|Updated Mar 4, 2026
Search Tags:#security#privilege escalation#bypass#red team#mitigation#windows
One-click install
npx skills add https://github.com/SnailSploit/Claude-Red --skill windows-boundaries
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: windows-boundaries
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-windows-boundaries
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill windows-boundaries

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you understand and bypass the complex security boundaries within Windows, enabling effective privilege escalation and sandbox escape.

Core Features & Use Cases

  • Mitigation Fingerprinting: Identify active security features like VBS, HVCI, DEP, ASLR, CFG, and CET.
  • Bypass Techniques: Learn methods to circumvent AMSI, PPL, AppContainers, WDAC, ASR, and ETW telemetry.
  • Use Case: When planning a red team engagement, use this Skill to quickly assess the target's security posture and identify the most viable paths for privilege escalation or lateral movement.

Quick Start

Analyze the current system for active Windows security mitigations and potential bypass vectors.

Frequently Asked Questions about windows-boundaries

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify active Windows security mitigations before attempting privilege escalation?▼

You can perform mitigation fingerprinting to identify active Windows security features like VBS, HVCI, DEP, ASLR, CFG, and CET, which helps determine the most viable paths for privilege escalation during offensive reconnaissance.

What is the best way to bypass AMSI and ETW telemetry on Windows?▼

To bypass AMSI and ETW telemetry, you need to apply specific circumvent techniques that manipulate ETW and circumvent AMSI, effectively blinding endpoint detection systems during red team engagements.

How does sandbox escape work against Windows AppContainers and Protected Process Light?▼

Sandbox escape against Windows AppContainers and Protected Process Light (PPL) involves exploiting boundary vulnerabilities to break out of restricted environments, enabling lateral movement and elevated execution.

Do I need to understand Windows internals to use this bypass methodology?▼

Yes, understanding Windows internals and exploit development concepts is required to effectively apply this methodology for defeating kernel/user, COM/RPC, and hypervisor security boundaries.

Can I use this approach to bypass WDAC and ASR enforcement policies?▼

Yes, this methodology provides specific techniques to bypass Windows Defender Application Control (WDAC) and Attack Surface Reduction (ASR) policies, allowing you to circumvent application whitelisting and behavioral restrictions.

Why should I assess hypervisor boundaries during a red team engagement?▼

Assessing hypervisor boundaries is crucial because defeating them allows you to understand the complete security posture of the target, identifying whether virtualization-based security (VBS) can be bypassed for deeper system compromise.

Related Skills

Explore More Software Engineering Skills→
ArdurAIArdurAI
1

god-linux-mastery

Explain Linux kernel architecture, process management, and system operations.

Official
Advanced
wgpsecwgpsec
1.6k

post-exploit-linux

Plan and execute Linux post-exploitation workflows from initial access through privilege escalation.

Official
Advanced
riparinoriparino
1

defensive-shellcode

Detect shellcode in memory using YARA rules and KQL telemetry.

Community
Advanced
OmarMiraOmarMira

red-team-tactics

Explain MITRE ATT&CK phases for adversary simulation.

Community
Intermediate