offensive-edr-evasion

1# SKILL: Endpoint Detection and Response
2 
3## Metadata
4- **Skill Name**: edr-evasion
5- **Folder**: offensive-edr-evasion
6- **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/edr.md
7 
8## Description
9EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques.
10 
11## Trigger Phrases
12Use this skill when the conversation involves any of:
13`EDR evasion, EDR bypass, hook unhooking, direct syscalls, PPID spoofing, process injection, AMSI bypass, ETW patch, memory encryption, AV evasion, behavioral evasion, red team evasion`
14 
15## Instructions for Claude
16 
17When this skill is active:
181. Load and apply the full methodology below as your operational checklist
192. Follow steps in order unless the user specifies otherwise
203. For each technique, consider applicability to the current target/context
214. Track which checklist items have been completed
225. Suggest next steps based on findings
23 
24---
25 
26## Full Methodology
27 
28# Endpoint Detection and Response
29 
30## Fundamentals
31 
32### AV vs EDR
33 
34**Antivirus (preventive approach)**:
35 
36- Static Analysis: Matching known signatures in files
37- Dynamic Analysis: Limited behavioral monitoring/sandboxing
38- Effective against known threats, weaker against advanced attacks
39 
40**EDR (proactive & investigative approach)**:
41…