2 min read

Red Team

Defense Evasion Techniques

The orientation to Windows defense evasion, not the technique catalogue: three things worth understanding before you pick a bypass, and a pointer to where the bypasses live — 09f — EDR Bypass.

Authorization boundary — bypassing the client's controls

Confirm the scope covers bypassing the client's controls, and tell the SOC which host and window you are using. The boundary is per action, not per engagement: unhooking a userland API is a policy test, while loading a vulnerable driver, killing an EDR agent's process or patching kernel callbacks disables the control the client is paying you to measure. Those need the written objective to name the control test, the host and the rollback, and they need a lab run first — a bad BYOVD load is a blue screen on a production endpoint.

What This Page Covers

API hooks are the first layer: user-mode inline hooks in ntdll, placed by the EDR's own DLL, which see every memory and thread operation your implant performs. The userland/kernel boundary is the second, and it is the one most evasion advice gets wrong — hooks, ETW patching and syscall stubs live in your process, while kernel callbacks and ETW Threat Intelligence are on the other side of it. And evasion is an arms race: every published bypass is a signature within weeks, so measure how long a technique survives against this client's product and version, not whether it is called undetected.

For the mechanics — AMSI, unhooking, direct and indirect syscalls, BYOVD, ETW blinding, sleep obfuscation, PPID spoofing — use 09f, which also carries the per-EDR analysis and the detection table. Payload construction is 09g; operator hygiene is 09d.

Related Topics

EDR Bypass

AMSI, unhooking, syscalls, ETW, sleep obfuscation

Payload Development

Build and stage the implant

C2 Frameworks

Command and control setup

OPSEC

Operational security

Related Tools

Use the interactive toolset as a nearby operator companion while working through this guide.

Interactive Tool

Nmap Builder

Generate internal discovery and service-enumeration scans that map cleanly to the scanning and enumeration phases.
Interactive Tool

Reverse Shell Generator

Keep payload generation close to the exploitation workflow when you need a fast fallback shell during lateral movement.
Interactive Tool

Port Reference

Cross-check exposed services and odd internal ports while triaging hosts, shares, and management interfaces.
Interactive Tool

Findings Library

Translate credential, AD, relay, and privilege-escalation chains into report-ready language for internal engagements.