1. NOW

   : Read

   ../field-journal/precedent-reverse.md

   — Confirm that the operations of this skill are authorized routine actions

2. NOW

   : Confirm whether the current task falls within the scope of application of this skill

3. NEXT

   : Read

   ../tool-index.md

   to verify tool availability and actual paths

4. NEXT

   : Call bootstrap when tools are missing, do not guess paths

5. ACT

   : Proceed to the first step of the "Workflow" and execute, do not stay in the confirmation state

For authorized red team / adversary simulation / in-house product testing only. Prohibited for unauthorized targets.

1. Red Team / Purple Team / Adversary Simulation — Customers want to evaluate the real detection capabilities of SOC and EDR
2. In-House Implant / C2 Framework Development — Develop payloads for testing own products, need to bypass own or target EDR
3. EDR Product Evaluation — Objectively evaluate the detection coverage of a certain EDR under confirmed compliance boundaries
4. CTF / Windows Endpoint Breakthrough in Offensive and Defensive Drills — Need to execute stably on hardened hosts during competitions

• Antivirus vendors conduct complete RE of their own products to provide customers with commercial evaluation reports (seek official cooperation with vendors)
• Evasion对抗 on unauthorized targets (illegal)
• Evasion of ordinary malware (This skill focuses on red team OPSEC, does not teach malicious code writing)

Four main monitoring surfaces of EDR               Red Team Countermeasures
─────────────────────              ─────────────────────
User-mode ntdll hook       ◄──►   unhook (Peruns Fart / fresh ntdll)
                                  indirect syscall / Hell's Gate
                                  hardware breakpoint Blindside

kernel callback         ◄──►   call stack spoof
(Ps/Cm/Ob series)                   Follow legitimate trigger chains (do not bypass directly, cooperate with upstream stealth)

ETW telemetry           ◄──►   EtwEventWrite patch
(Microsoft-Windows-Threat-          NtTraceControl disable provider
 Intelligence, etc.)                  AmsiContext synchronous processing

AMSI scanning               ◄──►   AmsiScanBuffer patch (mov eax,0x80070057; ret)
(amsi.dll)                       hardware breakpoint bypass
                                  reflective loading of duplicate amsi.dll

• EDR is not a black box — Key hooks / callbacks / providers can be reverse-engineered using IDA + windbg
• Bypass techniques need to be combined — A single unhook cannot solve ETW alerts, a single AMSI patch cannot solve syscall hooks
• Order matters — First ETW patch → then AMSI patch → then unhook; if the order is wrong, EDR will receive unhook alerts first
• Modern EDR has taken ETW + kernel callback as the main battlefield, pure user-mode unhook is no longer sufficient

1. Attach to a process injected with EDR user-mode components (any landed process)
2. Dump the

   .text

   section of the current

   ntdll.dll

   in windbg
3. Compare it with the clean

   C:\Windows\System32\ntdll.dll

   on disk
4. Inconsistent areas are hook points

pe-sieve

pe-sieve64.exe /pid 1234 /shellc 3 /modules 3 /dir hooks_dump

references/hook-survey.md

• Use legitimate software directories for file landing paths
• PPID spoof to explorer.exe
• Cooperate with the initial access section in

  attack-chain

• reverse-engineering/

  — Need to first understand the implementation of EDR DLL / driver

• attack-chain/

  — Decide at which stage of the kill chain to introduce this skill

• pentest-tools/network-attack-defense.md

  — How to link with this skill during internal network lateral movement

• malware-analysis/

  — Reverse perspective, see how detection parties write rules

• field-journal/

  — Write back experience after each actual combat

• Reference MITRE ATT&CK T1562 (Impair Defenses), T1562.001 (Disable or Modify Tools), T1562.006 (Indicator Blocking), T1055 (Process Injection), T1027 (Obfuscated Files or Information) when generating reports

• For authorized red team / adversary simulation / in-house product testing only
• Must obtain written authorization (SoW / test contract / SRC scope description) before operation
• Do not use on unauthorized targets, do not exceed the authorized scope
• Immediately report high-risk issues to customers, follow responsible disclosure
• All real target information in reports must be desensitized (IP / hostname / domain name / credential placeholders)

• Detailed hook research:

  references/hook-survey.md

• unhook / syscall techniques:

  references/unhook-techniques.md

• ETW / AMSI / anti-forensics:

  references/telemetry-blinding.md

• MITRE ATT&CK T1562: https://attack.mitre.org/techniques/T1562/

• Have I executed every step in the workflow (instead of just reading)?
• Have I used real tool paths based on

  tool-index

  ?
• Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
• Have I completed and written back the Checklist items required by RULES?