edr-bypass-re
ZHTargeted endpoint-evasion tests for red teams.
What it does
Guides reverse engineering of endpoint defenses and development of targeted evasion techniques for authorized red-team implants.
When to use it
Use when an authorized red-team or adversary-simulation engagement needs to deploy an implant on a host monitored by modern endpoint defenses.
How to use it
Give it an authorized implant-development or testing task; it guides implementation of targeted endpoint-defense evasion and sandbox validation.
What you provide
- An existing project
Uses
Good to know
- cannot be undone: PowerShell history; C:\Windows\System32\winevt\Logs\Security.evtx; C:\Windows\Prefetch\implant*.pf; HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell
- works out of sight
What you need · 5
The host workflow targets Windows processes, system DLLs, and endpoint defenses.
The main hook-inspection workflow uses windbg to attach to a process and dump its loaded system DLL; the tool must be installed separately.
Access · 8
This skill
PowerShell history
Clears your PowerShell history (irreversible)
C:\Windows\System32\winevt\Logs\Security.evtx
Deletes the Windows Security log (irreversible)