The Agent Skills Directory

[COMMAND_EXECUTION]: Provides detailed, actionable patterns for stealthy command and shellcode execution, including process injection techniques such as Early Bird APC, Thread Hijacking, PoolParty, and Threadless Injection via DLL notifications.
[PRIVILEGE_ESCALATION]: Describes methods to escalate privileges and bypass security boundaries, including Bring Your Own Vulnerable Driver (BYOVD) to disable EDR processes, Protected Process Light (PPL) bypass techniques, and token impersonation for parent PID spoofing.
[PERSISTENCE]: Catalogs numerous persistence mechanisms for both Windows and Linux, including shell profile modification (~/.bashrc, ~/.profile), systemd unit creation, cron job scheduling, and Windows Registry persistence.
[OBFUSCATION]: Outlines sophisticated techniques to hide malicious intent and bypass static signatures, such as compile-time string XOR encryption, custom Base64 alphabets to manipulate entropy scores, and zlib compression to evade YARA rules.
[REMOTE_CODE_EXECUTION]: Details patterns for fileless remote code execution, such as using memfd_create combined with fexecve on Linux to execute payloads directly from memory without touching the disk.
[DATA_EXFILTRATION]: Instructs on accessing and exfiltrating sensitive system data, referencing paths such as /etc/shadow, ~/.ssh/id_rsa, and registry-based credentials for lateral movement and data theft.
[CREDENTIALS_UNSAFE]: Explicitly identifies sensitive credential stores for targeting, including SSH private keys, AWS credentials, and GPG keys as primary objectives for collection.

edr-evasion-dev