edr-evasion

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable techniques for evading endpoint protections, disabling telemetry (AMSI/ETW), performing process injection/remote code execution, kernel-level bypasses, and stealth/persistence measures consistent with deliberate malicious/backdoor behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill provides explicit, actionable instructions to modify system components (patch ntdll/AMSI/ETW in memory, use kernel drivers, direct syscalls, process injection, PPID spoofing) which directly compromise the host's security and state.