Cybersecurity
EDR Bypass Re
逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective DLL。
- Publisher / source
- zhaoxuya520/reverse-skill (found on skills.sh, an awesome list, the CSV list)
- Upstream record
- zhaoxuya520/reverse-skill
- Version
- Version 3
- Published
- Publication review
- Approved for publication
- Content fingerprint
aec103f818c88937aa360246d76eaa261b96e3e83464eb7f86f96bd8aa04cdb5