Agent skill · security · yaklang
windows-av-evasion
AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, shellcode execution, process injection, API hooking, and signature-based detection on Windows endpoints.
Why this skill is useful
Includes detailed executable scripts and techniques for bypassing multiple AV/EDR detection mechanisms that are not publicly documented.
What it needs
Requires donut installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: AV/EDR Evasion — Expert Attack Playbook AI LOAD INSTRUCTION: Expert AV/EDR evasion techniques for Windows. Covers AMSI bypass, ETW bypass, .NET assembly loading, shellcode execution, process injection, unhooking, payload encryption, and signature evasion. Base models miss detection-specific bypass chains and syscall-level evasion nuances. 0. RELATED ROUTING Before going deep, consider loading: windows-privilege-escalation when privesc tools are blocked by AV windows-lateral-movement when lateral movement tools trigger EDR active-directory-kerberos-attacks when Rubeus/Mimikatz are detected active-directory-acl-abuse for non-binary AD attacks (less AV-sensitive) Advanced Reference Also load AMSIBYPASSTECHNIQUES.md when you need: Detailed AMSI bypass code patterns (memory patching, reflection) PowerShell-specific AMSI bypasses .NET AMSI bypass techniques --- 1. AMSI BYPASS OVERVIEW AMSI (Antimalware Scan Interface) inspects PowerShell, .NET, VBScript, JScript, and Office macros at runtime. Key AMSI Bypass Categories Category Method Detection Risk Persistence --- --- --- --- Memory patching Patch AmsiScanBuffer in amsi.dll Medium Per-process Reflection Modify AMSI init flags via .NET reflection Medium Per-session String obfuscation Encode/split AMSI trigger strings Low Per-payload PowerShell downgrade Force PS v2 (no AMSI) Low Per-session CLM bypass Escape Constrained Language Mode Medium Per-session COM hijack Redirect AMSI COM server Low Per-user Quick AMSI Bypass (One-Liners) --- 2. ETW BYPASS ETW (Event Tracing for Windows) feeds telemetry to EDR. Patching EtwEventWrite stops .NET assembly load events. Patch EtwEventWrite PowerShell ETW Bypass --- 3. .NET ASSEMBLY LOADING In-Memory Assembly.Load Donut — Convert .NET Assembly to Shellcode execute-assembly (C2 Framework) --- 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/windows-av-evasion