agentleFS
Sign inStart free
DorianGalloDorianGallo/reverse-skill/skills/edr-bypass-re/SKILL.md

edr-bypass-re

Skill2 starsChanged 5 months agoLicence not identifiedView on GitHub

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective DLL。

Create a free account to mount
  • Other versions6 projects use a version of this.

    Word for word · 1

    1. 2233admin/reverse-skill-evolver★ 26100% same

    Wrote their own version · 0

    None found.

    How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.

  • Used alongsideProjects with it also use ghidra-reverse and case-review.

    Other files people use alongside this one.

    Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
    • zhaoxuya520Skill

      ghidra-reverse

      Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.

      Also in 3 projects that use this

    • Youchu-lawhubSkill

      case-review

      收到裁判文书后的研析与复盘——三级覆盖：庭审复盘（庭后五维效果分析）、裁判文书研析报告（主体/诉请与判决/请求权/事实查明/说理/裁判结果六维 + 逐页比对事实认定与证据采信、提炼胜败因）、结案复盘报告（结案报告十项 + 四维反思）。两种深度：自办案件（调取台账/事实梳理/过程文书做深度复盘）与非自办/受限信息（仅基于用户提供的裁判文书与有限信息），输出面向客户/法务领导/业务部门汇报。触发词：复盘、裁判文书分析、判决分析、研析判决、结案报告、结案复盘、办案总结、庭审复盘、败诉分析。

      Also in 3 projects that use this

  • In this repository21 other files it gives its agents.

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free