edr-evasion

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This is a high-risk malicious playbook: it provides explicit, actionable techniques to bypass EDR/AV (hook unhooking, direct/indirect syscalls), disable security controls (AMSI/ETW patching), perform stealthy process injection and PPID spoofing, and implement memory encryption and behavioral gatekeeping—facilitating covert backdoors, remote code execution, and persistent post‑compromise activity.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt contains explicit, actionable instructions and code to bypass EDR/AV and modify system components (patch ntdll/amsi/etw, perform direct syscalls, DKOM/BYOVD, process injection and PPID spoofing), which actively alter system state and circumvent security mechanisms.