defense-evasion - Endpoint Defense Evasion Knowledge Base
Documents AMSI and ETW patching, ScareCrow payload generation, custom loaders, syscalls, LOLBAS execution, and process injection.
Tags
Updated: 2026-10-06Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Explain endpoint defense evasion
- Map techniques to MITRE ATT&CK
- Compare AMSI bypass methods
- Describe ETW patching
- Document ScareCrow payload options
- Compare custom shellcode loaders
Inputs
- Target security stack
- Shellcode or implant files
- Loader language and options
- Output payload path
Outputs
- Defense evasion guidance
- MITRE ATT&CK mappings
- AMSI and ETW examples
- ScareCrow command examples
- Custom loader examples
- OPSEC comparison tables
Requirements
- Bash, Read, and Write tool access