Edr Evasion

This covers the full spectrum of endpoint detection evasion: unhooking ntdll to remove userland hooks, direct and indirect syscalls to bypass monitored APIs, PPID spoofing to blend into legitimate process trees, and patching AMSI and ETW to blind telemetry. The source material is thorough, with actual C and assembly snippets for techniques like mapping clean ntdll from KnownDlls, resolving syscall numbers with HellsGate, and implementing sleep masking to encrypt beacon memory during idle periods. Use this when you're developing implants that need to survive modern EDR or testing your own detection stack. The skill also covers process injection variants ranked by stealth level, from basic CreateRemoteThread to threadless injection that avoids spawning new threads entirely. One honest take: this is pure red team tradecraft, so context matters.

Install to Claude Code

npx -y skills add hypnguyen1209/offensive-claude --skill edr-evasion --agent claude-code