edr-evasion-dev
Installation
SKILL.md
EDR Evasion — Universal Patterns & Constraints
Windows and Linux EDR/XDR reference material. Product-specific observations require the original artifact, sensor version, configuration, and result; the presence of a technique or citation here does not establish verification against SentinelOne, Defender, CrowdStrike, or another product.
Cross-Platform Routing
Depth in this SKILL.md is Windows. Load references based on the target OS.
| Target profile | Load |
|---|---|
| Windows 10/11 loader, implant, tool | This body §0–§14 + references/constraints.md |
CET-enforced host process (query ProcessUserShadowStackPolicy — user-mode shadow stack is per-image opt-in, not a 24H2 default) |
Same + references/kernel-telemetry.md — read §CET before choosing spoof strategy |
| Linux host with Falco / Tetragon / Tracee / Elastic Defend / any eBPF EDR | references/linux-edr-evasion.md — do not port Windows patterns |
| Designing a new loader / auditing an existing one (either OS) | references/best-practices.md — signal-cost budget, minimalism gate, CI-under-test |
| Interpreting kernel telemetry and collection gaps | references/kernel-telemetry.md — distinguish provider schemas, deployed configuration, and observed events |
Golden rule for cross-OS work: usermode evasion primitives never transfer. Indirect syscalls, ETW patching, SilentMoonwalk, HWBP are Windows-only. LD_PRELOAD, io_uring, memfd, BPF map poisoning are Linux-only. What transfers is the doctrine: evasion minimalism, signal-cost budget, staged loader hygiene, telemetry-first design (see best-practices.md).