Evasion-SubAgents: Command for Claude Code

You are tasked with analyzing a penetration testing tool and modifying its source code to evade detection.

Input

Tool Path: {{tool_path}}

Workflow

Follow these phases in order:

Phase 1: Tool Understanding

1. Read README and documentation files
2. Analyze source code structure
3. Identify programming language and build system
4. Determine tool purpose and use cases
5. Create tool profile at rules/{tool_name}/tool_profile.md

Phase 2: Open Source Detection (if applicable)

1. Check if the tool is open source
2. Extract keywords (name, author, features)
3. Search GitHub for tool-specific detection rules
4. Save found rules to rules/{tool_name}/yara/, rules/{tool_name}/sigma/, etc.

Phase 3: Behavior Analysis

1. Analyze source code for core behavior patterns:
   • Network behavior (HTTP headers, URLs, ports)
   • Process behavior (creation, injection)
   • File behavior (paths, operations)
   • API usage patterns
   • String constants
2. Extract behavioral signatures
3. Search for behavior-based detection rules
4. Save found rules

Phase 4: Rule Collection

1. Organize all found rules
2. Create rule inventory at rules/{tool_name}/rule_inventory.md
3. Categorize by type (YARA, Sigma, Network, etc.)

Phase 5: Per-Rule Analysis

For EACH detection rule found:

1. Parse all patterns (strings, hex, regex)
2. Identify pattern sources in the tool code
3. Develop evasion strategies (prioritize compiler flags)
4. Create analysis file at rules/{tool_name}/rule_analysis/{rule_name}.md

Phase 6: Source Modification

CRITICAL: Directly modify source files using Edit tool.

1. FIRST: Try build configuration changes (compiler flags)
2. SECOND: Apply source code modifications if needed
3. Create tasks for each modification
4. Verify each change

Modification priority:

1. Compiler flags (lowest effort, highest impact)
2. Build configuration
3. String obfuscation
4. API obfuscation
5. Function rename
6. Behavior change (last resort)

Phase 7: Verification & Summary