The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes an 'AI LOAD INSTRUCTION' designed to influence the AI's behavior by suggesting that base models lack necessary depth for 'detection-specific bypass chains,' encouraging the agent to provide potentially unsafe evasion content that safety filters might otherwise restrict.
[COMMAND_EXECUTION]: The skill provides high-risk PowerShell and C# code for patching critical system functions like 'AmsiScanBuffer' in amsi.dll and 'EtwEventWrite' in ntdll.dll to disable security monitoring and event logging.
[REMOTE_CODE_EXECUTION]: Sections describing '.NET Assembly Loading' and 'Staged Loading' provide patterns for fetching, decrypting, and executing remote payloads directly in memory to avoid disk-based detection.
[DYNAMIC_EXECUTION]: Detailed instructions for sophisticated process injection techniques are provided, including 'Early Bird APC Injection,' 'Process Hollowing,' and 'Module Stomping,' as well as the use of Windows callback APIs (e.g., EnumWindows) to execute shellcode.
[OBFUSCATION]: The skill explicitly teaches techniques to evade signature-based detection, including string XORing, API hashing to hide function calls, and the use of 'ConfuserEx' for .NET metadata obfuscation.
[PERSISTENCE]: In 'AMSI_BYPASS_TECHNIQUES.md', the skill describes a COM Server Hijack method that modifies the Windows Registry ('HKCU\Software\Classes\CLSID{fdb00e52-a214-4aa1-8fba-4357bb0072ec}') to redirect AMSI to a fake DLL, which can serve as a persistence mechanism to maintain a disabled security state across user sessions.

windows-av-evasion