edr-evasion-dev

The reported scanner matches do not establish pre-execution behavior or credential theft. However, the skill explicitly provides detailed operational guidance for evading endpoint defenses and deploying stealthy implants, including injection, persistence, and C2 concealment. Its stated purpose and capabilities are aligned, but that alignment creates substantial security risk; classify as high risk rather than confirmed malware.

High severity: this is a detailed Linux EDR/XDR evasion and intrusion playbook covering sensor fingerprinting, monitoring suppression, fileless execution, injection, persistence, and concealed C2, including paths such as /etc/ld.so.preload and /etc/systemd/system/ and variables such as LD_PRELOAD. It is documentation, not executable malware in this fragment, and it identifies no specific attacker domain, IP, or credential target. The content nevertheless provides actionable guidance for unauthorized evasion and persistence and should be treated as high risk.

This is non-executable documentation that provides detailed, actionable guidance for developing stealthy loaders, implants, C2 tooling, and sensor-evasion techniques, including kernel/eBPF sensor blinding. It contains no direct malware execution, credentials, or specified network indicators, so malware presence in this file is not established; however, its explicit evasion and deployment guidance presents a high security risk if used to implement unauthorized tooling.

This fragment is non-executable documentation, but it provides detailed operational guidance for shellcode execution, process injection, anti-analysis, and EDR evasion on Windows and Linux. No actual data theft, persistence, or payload execution is implemented in the shown text, so malware presence in this fragment is not established. Its content is strongly indicative of offensive implant development and presents a high security concern if used as implementation guidance; it references falco[.]org and thefLink/Hunt-Sleeping-Beacons. Severity: high for dual-use/evasion guidance, with no direct runtime impact from this fragment alone.

This fragment is non-executable technical prose, not malware, and makes no system or network changes by itself. It provides detailed, actionable process-injection and EDR-evasion guidance, so its content has elevated dual-use security risk. Referenced domains are research.checkpoint[.]com and blog.fndsec[.]net; no live connections are made. Malware likelihood is low, while the risk reflects the operational guidance rather than executable behavior.

This fragment is high-risk attacker tradecraft guidance for anti-debug/anti-VM evasion and stealth execution. It specifies how to detect analysis environments, selectively trigger evasive branching, conceal static indicators (IAT/API/string hiding and late binding), and manipulate entropy/section placement to reduce ML/AV detection. No direct malicious execution is shown here, but the intent and techniques are strongly consistent with malware/loader development. Additional code context would be required to confirm that the referenced behaviors are actually implemented in the package.

This fragment describes a high-risk ETW-evading loader technique: temporary byte-stomping of ntdll’s NtTraceEvent and EtwEventWrite prologues using NtWriteVirtualMemory (self-target) to suppress telemetry during a short window, then restoring original bytes to evade integrity checks before handoff to longer execution. While actual implementational details are not present, the described intent and concrete patch-and-restore workflow are strongly consistent with malicious staging/stealth behavior.