Enumerate EDR/AV Drivers for Red Team Assessments

This skill provides a structured workflow for evading Windows Endpoint Detection and Response (EDR) systems during authorized security assessments. It documents four primary EDR monitoring surfaces - user-mode ntdll hooks, kernel callbacks, ETW telemetry, and AMSI scanning - and references bypass techniques including unhooking, indirect syscalls, call stack spoofing, and telemetry blinding. The material is intended for authorized penetration tests, purple team exercises, and controlled lab environments only.

Use this skill when conducting authorized red team engagements where the client wants to evaluate their SOC and EDR detection capabilities, when developing custom implants or C2 frameworks that need to bypass specific EDR products in controlled testing, when objectively assessing EDR product coverage within compliance boundaries, or during CTF competitions requiring Windows host compromise. Do NOT use this for unauthorized targets (illegal), for commercial malware development, or to bypass EDR on production systems without explicit written authorization and defined scope.

You provide the target host details, written authorization documentation, and the specific EDR product deployed (identified via service enumeration). The skill walks you through a six-step workflow: identifying the EDR via PowerShell commands, extracting hook tables from EDR DLLs using tools like pe-sieve, selecting appropriate bypass technique combinations, implementing them in your implant, validating in a sandbox environment with Sysmon, and finally deploying with proper operational security. The workflow references code examples, technique combinations, and verification steps.

### List common EDR / AV drivers
Get-Service | Where-Object {$_.Name -match 'CSAgent|SentinelAgent|elasticendpoint|esets|ekrn|MsMpEng|wdsvc|cyserver|sysmon|aswbidsagent'}

### List loaded minifilters
fltmc filters

pe-sieve64.exe /pid 1234 /shellc 3 /modules 3 /dir hooks_dump

The skill references pe-sieve for detecting hooks and injections in running processes, API Monitor v2 for dynamic API call observation, SysWhispers3 for generating direct and indirect syscall stubs, Hell's Gate POC for dynamic SSN resolution, WinDbg and IDA for static reverse engineering of EDR DLLs and kernel callbacks, and Sysmon with olaf config for local validation environments. A PowerShell bootstrap script is mentioned for automating installation of pe-sieve, SysWhispers3, and Sysmon.

This skill serves authorized penetration testers and red team operators who need to deliver implants past modern EDR defenses, purple team members evaluating detection coverage, security researchers developing custom C2 frameworks for internal testing, and CTF competitors facing hardened Windows targets. It differs from general attack-chain skills by focusing exclusively on the EDR adversary's internal mechanisms rather than full kill chains, and from static evasion techniques by addressing runtime telemetry and kernel-level monitoring.