Edr Bypass Re

---
name: edr-bypass-re
description: |
  Reverse engineer defense implementations to red team targeted bypass. First reverse EDR / Defender / AV hook tables, ETW providers, AMSI implementations,
  then write targeted unhook / indirect syscall / ETW patch / call stack spoof. Maps to MITRE ATT&CK T1562 Defense Evasion.
  Trigger keywords: EDR bypass, AV bypass, unhook, direct syscall, indirect syscall, Hell's Gate, Halo's Gate,
  Tartarus Gate, ETW patch, AMSI patch, call stack spoofing, hardware breakpoint Blindside, MITRE T1562,
  ntdll unhook, kernel callback, CrowdStrike bypass, Defender bypass, Sentinel One bypass, Elastic Defend,
  Sysmon evasion, PPID spoof, Sleep mask, Process Hollowing, Reflective DLL.
---

## ACTION REQUIRED (execute immediately after reading)

2. `NOW`: Confirm the current task matches this skill's scope
4. `NEXT`: When tools are missing, call bootstrap - do not guess paths
5. `ACT`: Enter the first step of the "Workflow" and execute - do not stop at confirmation state

# EDR Bypass: From Defense Implementation Reverse Engineering to Red Team Bypass

> Authorized red team / adversarial simulation / own product testing only. Unauthorized targets are prohibited.

## Scope

Red team / adversarial simulation delivering implants and evading modern EDR on authorized target hosts.

1. **Red team / Purple team / adversarial simulation** - client wants to assess SOC and EDR real detection capability
2. **Custom implant / C2 framework development** - develop payloads for testing own products, need to bypass own or target EDR
3. **EDR product evaluation** - objectively evaluate EDR detection coverage with confirmed compliance boundaries
4. **CTF / adversarial exercise Windows breakthrough** - need stable execution on hardened hosts during competition

**Not applicable:**
- Antivirus vendor doing complete RE on own product for commercial assessment report (find vendor partnership)
- Unauthorized target evasion (illegal)
- Generic malware evasion (this skill focuses on red team OPSEC, not malware writing)

### Division of labor with other skills

| Scenario | Use which |
|----------|-----------|
| Full kill chain (external to domain controller) | `attack-chain/` |
| Internal lateral / AD attack | `pentest-tools/network-attack-defense.md` |
| Delivering implant past EDR on specific host | **This skill** |
| Static evasion only (obfuscation / packing) | `malware-analysis/` (reverse perspective) |

`attack-chain` covers complete kill chain, this skill focuses on **EDR as a single adversary** - its internal mechanisms and targeted bypasses.

## Core principle

```text
EDR's four main monitoring surfaces          Red team countermeasures
─────────────────────                        ─────────────────────
User-mode ntdll hook         <--->   unhook (Peruns Fart / fresh ntdll)
                                        indirect syscall / Hell's Gate
                                        hardware breakpoint Blindside

kernel callback              <--->   call stack spoof
(Ps/Cm/Ob series)                    use legitimate trigger chain (don't bypass directly, coordinate with upstream stealth)

ETW telemetry                 <--->   EtwEventWrite patch
(Microsoft-Windows-Threat-            NtTraceControl disable provider
 Intelligence etc)                    AmsiContext sync handling

AMSI scan                     <--->   AmsiScanBuffer patch (mov eax,0x80070057; ret)
(amsi.dll)                            hardware breakpoint bypass
                                        reflective load copy amsi.dll
```

Key insights:

- **EDR is not a black box** - key hooks / callbacks / providers can be reversed with IDA + windbg
- **Bypass techniques must be combined** - standalone unhook won't solve ETW alerts, standalone AMSI patch won't solve syscall hooks
- **Order matters** - first ETW patch -> then AMSI patch -> then unhook; wrong order lets EDR receive unhook alert first
- **Modern EDR has moved ETW + kernel callback to main battlefield**, standalone user-mode unhook is no longer sufficient

## Workflow

### Step 1: Identify target host EDR

```powershell
# List common EDR / AV drivers
Get-Service | Where-Object {$_.Name -match 'CSAgent|SentinelAgent|elasticendpoint|esets|ekrn|MsMpEng|wdsvc|cyserver|sysmon|aswbidsagent'}

# List loaded minifilters
fltmc filters

# List registered kernel callbacks (needs windbg + kernel debugging / or PChunter / DRVHV)
# !object \Callback
# !pnpcallback / Process / Thread / Image
```

EDR fingerprint table at top of `references/hook-survey.md`.

### Step 2: Extract hook table from EDR DLL

1. Attach to a process injected with EDR user-mode component (any landed process)
2. In windbg, dump current `ntdll.dll` `.text` section
3. Diff against clean `C:\Windows\System32\ntdll.dll` on disk
4. Inconsistencies are hook points

Or use `pe-sieve` directly:

```powershell
pe-sieve64.exe /pid 1234 /shellc 3 /modules 3 /dir hooks_dump
```

Detailed method in `references/hook-survey.md`.

### Step 3: Choose bypass technique combination

| Defense point | Recommended bypass |
|---------------|-------------------|
| ntdll inline hook | indirect syscall + dynamic SSN (Halo's Gate) |
| ETW-TI provider | EtwEventWrite head patch |
| AMSI (PowerShell / .NET) | AmsiScanBuffer patch or HWBP |
| kernel callback | call stack spoof + use legit gadget |
| Sysmon ProcessCreate | PPID spoof + unbacked memory |

### Step 4: Implement in implant

Code skeleton in `references/unhook-techniques.md` and `references/telemetry-blinding.md`.

### Step 5: Local sandbox verification

```powershell
# Deploy target EDR trial in isolated environment (Defender default is fine to start)
# Enable Sysmon + olaf-config
sysmon64.exe -i sysmonconfig.xml

# Run implant, check if these alert sources trigger:
#   - Defender AMSI
#   - ETW-TI
#   - Sysmon Event ID 1/7/8/10
#   - EDR console
```

### Step 6: Delivery

- File drop path uses legitimate software directory
- PPID spoof to explorer.exe
- Coordinate with `attack-chain` initial access section

## Typical scenarios

### Scenario 1: Deliver cobalt-strike-alike beacon past Defender + Sysmon

```text
Target: Windows 11 Enterprise + Defender (cloud scan on) + Sysmon (olaf config)
Requirement: beacon lands, callbacks, triggers no alerts

Combination:
  1. Shellcode encrypted at rest, decrypted at runtime
  2. AMSI patch (if PowerShell delivery)
  3. EtwEventWrite patch (kill ETW-TI)
  4. Indirect syscall + Halo's Gate (kill ntdll hook alerts)
  5. PPID spoof to explorer.exe
  6. Sleep phase uses Ekko / Foliage to encrypt own memory
```

### Scenario 2: EDR sleep mask on already-landed low-privilege shell

```text
Precondition: already have medium IL shell via phishing, EDR monitoring
Risk: long dwell time risks beacon memory signatures being detected by memory scan
Risk: long dwell time risks beacon memory signatures being detected by memory scan

Solution:
  1. No new RWX memory allocation
  2. Sleep uses Ekko:
       - WaitForSingleObjectEx + CreateTimerQueueTimer
       - In timer: encrypt own .text + zero out stack
  3. Wake uses ROP to restore
  4. Coordinate with call stack spoof so RtlCaptureStackBackTrace can't see beacon address
```

## On-Demand Bootstrap

### Tool dependencies

| Tool | Purpose | Auto-installable |
|------|---------|:-:|
| pe-sieve | Detect hooks / injection in processes | Yes |
| API Monitor v2 | Dynamically observe API calls and hooks | Semi-auto (manual download) |
| SysWhispers3 | Generate direct / indirect syscall stubs | Yes (git clone + python) |
| Hell's Gate POC | Dynamic SSN resolution reference implementation | Yes (git clone) |
| windbg + IDA | Static reverse EDR DLL / kernel callback | No (install yourself) |
| Sysmon + olaf config | Local verification environment | Yes |

### Bootstrap command

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File "<SKILL_ROOT>\skills\scripts\bootstrap-reverse.ps1" -Capability @('pe-sieve','syswhispers3','sysmon') -StartServices
```

## Routing co