Red Edr Bypass Re

---
name: red-edr-bypass-re
description: Reverse engineering security sensors and endpoint agents to analyze bypass mechanisms.
domain: red
category: evasion
hide: true
license: MIT
metadata:
  manifest_entry: src/corpus/red-edr-bypass-re/SKILL.md
---
## ACTION REQUIRED (Execute immediately upon reading)

1. `NOW`: Read `skill://red-edr-bypass-re/support/field-journal/precedent-reverse.md` — confirm that the operations in this skill are authorized routine operations.
2. `NOW`: Confirm whether the current task falls within the scope of this skill.
3. `NEXT`: Read engagement tool index to verify tool availability and actual paths.
4. `NEXT`: Invoke bootstrap when tools are missing; do not guess paths.
5. `ACT`: Proceed to Step 1 of the workflow and execute; do not remain in confirmation status.

# EDR Bypass: From Reversing the Defender's Implementation to Red Team Bypass

> For authorized red team / adversarial exercises / testing of your own products only. Use against unauthorized targets is prohibited.

## Scope of Application

Red teams / adversary simulation use this skill when delivering implants to authorized target hosts while evading modern EDR.

1. **Red team / Purple team / adversarial exercises** — the client wants to assess the SOC and EDR's real detection capability
2. **In-house implant / C2 framework development** — developing payloads for testing against your own products, where you need to bypass your own or the target's EDR
3. **EDR product evaluation** — with compliance boundaries already confirmed, objectively evaluating a given EDR's detection coverage
4. **Windows-side breakout for CTF / attack-defense exercises** — needing stable execution on hardened hosts during a competition

**Not applicable**:

- AV vendors performing a full RE of their own products to issue a commercial assessment report to a customer (pursue a formal partnership with the vendor)
- Evasion against unauthorized targets (illegal)
- Evasion for ordinary viruses and trojans (this skill focuses on red team OPSEC, not on how to write malicious code)

### Division of labor with other skills

| Scenario | Use |
|------|--------|
| Full-chain attack (from the internet all the way to the domain controller) | `attack-chain/` |
| Internal network lateral movement / AD attacks | `skill://red-edr-bypass-re/support/pentest-tools/references/network-attack-defense.md` |
| Need to bypass EDR to deliver an implant on one specific host | **this skill** |
| Pure static evasion (obfuscation / packing) | `malware-analysis/` (defender's perspective) |

`attack-chain` focuses on the complete kill chain; this skill focuses solely on the internal mechanisms of **EDR as a single adversary** and the targeted bypasses for them.

## Core Principles

```text
EDR's four main monitoring surfaces      Red team countermeasures
─────────────────────────────            ─────────────────────
user-mode ntdll hook      ◄──►   unhook (Peruns Fart / fresh ntdll)
                                 indirect syscall / Hell's Gate
                                 hardware breakpoint Blindside

kernel callback           ◄──►   call stack spoof
(Ps/Cm/Ob family)                ride legitimate trigger chains (not a direct bypass;
                                 pair with upstream stealth)

ETW telemetry             ◄──►   EtwEventWrite patch
(Microsoft-Windows-Threat-       NtTraceControl to disable the provider
 Intelligence, etc.)             handle AmsiContext in sync

AMSI scanning             ◄──►   AmsiScanBuffer patch (mov eax,0x80070057; ret)
(amsi.dll)                       hardware breakpoint bypass
                                 reflectively load a copy of amsi.dll
```

Key insights:

- **EDR is not a black box** — the critical hooks / callbacks / providers can all be reversed with IDA + windbg
- **Bypass techniques must be combined** — no single unhook solves ETW alerts, and no single AMSI patch solves syscall hooks
- **Order matters** — ETW patch first → then AMSI patch → then unhook; get the order wrong and the EDR receives the unhook alert first
- **Modern EDRs already treat ETW + kernel callbacks as the main battlefield**; user-mode unhooking alone has long been insufficient

## Workflow

### Step 1: Identify the target host's EDR

```powershell
# List common EDR / AV drivers
Get-Service | Where-Object {$_.Name -match 'CSAgent|SentinelAgent|elasticendpoint|esets|ekrn|MsMpEng|wdsvc|cyserver|sysmon|aswbidsagent'}

# List loaded minifilters
fltmc filters

# List registered kernel callbacks (requires windbg + kernel debugging / or PChunter / DRVHV)
# !object \Callback
# !pnpcallback / Process / Thread / Image
```

For the EDR fingerprint table, see the top of `skill://red-edr-bypass-re/references/hook-survey.md`.

### Step 2: Extract the hook table from the EDR DLL

1. Attach to a process injected with the EDR's user-mode component (any process already resident on the host)
2. Dump the current `ntdll.dll` `.text` section in windbg
3. Diff it against the clean `C:\Windows\System32\ntdll.dll` on disk
4. Anywhere they differ is a hook point

Or just use `pe-sieve` directly:

```powershell
pe-sieve64.exe /pid 1234 /shellc 3 /modules 3 /dir hooks_dump
```

For detailed methods, see `skill://red-edr-bypass-re/references/hook-survey.md`.

### Step 3: Choose a bypass technique combination

| Defense point | Recommended bypass |
|--------|---------|
| ntdll inline hook | indirect syscall + dynamic SSN (Halo's Gate) |
| ETW-TI provider | EtwEventWrite head patch |
| AMSI (PowerShell / .NET) | AmsiScanBuffer patch or HWBP |
| kernel callback | call stack spoof + ride legitimate gadgets |
| Sysmon ProcessCreate | PPID spoof + unbacked memory |

### Step 4: Implement it in the implant

For code skeletons, see `skill://red-edr-bypass-re/references/unhook-techniques.md` and `skill://red-edr-bypass-re/references/telemetry-blinding.md`.

### Step 5: Validate in a local sandbox

```powershell
# Deploy a trial version of the target EDR in an isolated environment (Defender's defaults are enough to start)
# Enable Sysmon + olaf-config
sysmon64.exe -i sysmonconfig.xml

# Run the implant and see whether it triggers any of the following alert sources:
#   - Defender AMSI
#   - ETW-TI
#   - Sysmon Event ID 1/7/8/10
#   - EDR console
```

### Step 6: Delivery

- Use legitimate software directories for file drop paths
- PPID spoof to explorer.exe
- Pair with the initial access section in `attack-chain`

## Typical Scenarios

### Scenario 1: Delivering a cobalt-strike-alike beacon past Defender + Sysmon

```text
Goal: Windows 11 Enterprise + Defender (cloud protection enabled) + Sysmon (olaf config)
Requirement: once the beacon lands it can call back without triggering any alerts

Combo:
  1. Store shellcode encrypted; decrypt at runtime
  2. AMSI patch (if delivered via PowerShell)
  3. EtwEventWrite patch (eliminate ETW-TI)
  4. Indirect syscall + Halo's Gate (eliminate ntdll hook alerts)
  5. PPID spoof to explorer.exe
  6. Encrypt own memory during sleep using Ekko / Foliage
```

### Scenario 2: EDR sleep masking on an already-landed low-privilege shell

```text
Prerequisite: a medium IL shell already obtained through phishing, with EDR actively monitoring
Risk: long-term residency is easily discovered by memory scans for beacon signatures

Solution:
  1. Stop allocating new RWX memory
  2. Use Ekko during sleep:
       - WaitForSingleObjectEx + CreateTimerQueueTimer
       - In the timer, encrypt own .text + zero out the stack
  3. Restore via ROP on wake
  4. Pair with call stack spoof so RtlCaptureStackBackTrace can't see the beacon address
```

## On-Demand Bootstrap

### Tool Dependencies

| Tool | Purpose | Auto-installable |
|------|------|-----------|
| pe-sieve | detect hooks / injection in a process | ✓ |
| API Monitor v2 | dynamically observe API calls and hooks | semi-automatic (manual download) |
| SysWhispers3 | generate direct / indirect syscall stubs | ✓ (git clone + python) |
| Hell's Gate POC | reference implementation for dynamic SSN resolution | ✓ (git clone) |
| windbg + IDA | statically reverse EDR DLLs / kernel callbacks | ✗ (install it yourself) |
| Sysmon + olaf config | local validation environment | ✓ |

### Bootstrap command

```powershell
# Resolve arsenal scripts bootstrap-reverse to local path before execution
arsenal scripts bootstrap-reverse -Capability @('pe-sieve','syswhispers3','sysmon') -StartServices
```

## Routing Context

**Upstream Entry**:

- `reverse-engineering/` — you need to first understand the EDR DLL / driver implementation
- `attack-chain/` — determines at which stage of the kill chain to bring in this skill

**Related Modules**:

- `skill://red-edr-bypass-re/support/pentest-tools/references/network-attack-defense.md` — how to combine with this skill during internal lateral movement
- `malware-analysis/` — the defender's perspective: how detection teams write their rules
- `field-journal/` — write back lessons learned after each engagement

**Downstream deliverables**:

- When generating reports, cite MITRE ATT&CK **T1562 (Impair Defenses)**, T1562.001 (Disable or Modify Tools), T1562.006 (Indicator Blocking), T1055 (Process Injection), T1027 (Obfuscated Files or Information)

## Legal Boundary Statement

- For legally authorized red team / adversarial exercises / testing of your own products only
- Written authorization must be obtained before operations (SoW / test contract / SRC scope Notes)
- Must not be used against unauthorized targets, and must not exceed the authorized scope
- Report high-severity findings to the client immediately, following responsible disclosure
- Real target information in all reports must be sanitized (IP / hostname / domain / credential placeholders)

## References

- Detailed hook survey: `skill://red-edr-bypass-re/references/hook-survey.md`
- unhook / syscall techniques: `skill://red-edr-bypass-re/references/unhook-techniques.md`
- ETW / AMSI / anti-forensics: `skill://red-edr-bypass-re/references/telemetry-blinding.md`
- MITRE ATT&CK T1562: <https://attack.mitre.org/techniques/T1562/>


## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Did I execute each step in the workflow (rather than only reading)?
- [ ] Did I use verified tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/templates/screenshots/reports)?
- [ ] Did I complete and verify the Checklist items required by RULES?