edr-evasion
Fail
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides C code snippets that use low-level Windows APIs to manipulate memory and execution flow for malicious purposes.
- Evidence: Use of
VirtualProtect,memcpy, andCreateFileMappingto overwritentdll.dllmemory and remove security hooks. - Evidence: Implementation of Parent Process ID (PPID) spoofing using
UpdateProcThreadAttributeandCreateProcessAto conceal malicious process origins. - [PROMPT_INJECTION]: The skill contains instructions and code specifically designed to disable and bypass system monitoring and safety mechanisms.
- Evidence: Functional methods for patching
AmsiScanBufferinamsi.dllandEtwEventWriteinntdll.dllto blind security logging and malware scanning. - Evidence: Use of PowerShell snippets to disable AMSI via reflection and field manipulation.
- [REMOTE_CODE_EXECUTION]: The skill documents and provides logic for various advanced process injection techniques designed to execute arbitrary code within legitimate processes.
- Evidence: Implementation details for 'ThreadlessInject', 'Module Stomping', and 'Process Hollowing'.
- Evidence: Use of Direct and Indirect Syscalls in assembly to execute kernel functions while bypassing userland EDR hooks.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
Audit Metadata