EDR analysis & evasion (red team)

When it applies

An authorized red-team / adversary-emulation engagement requires an implant to survive on a host running a modern EDR, or you're evaluating an EDR's detection coverage against your own environment. Confirm the engagement covers defense evasion in writing first (tradecraft-scope-roe

• scope.txt) — this is pentest-only, never bug bounty. You need the EDR's internals understood (reverse-eng-binary-triage on its DLLs) before you can evade them deliberately.

Why it works

An EDR is not a black box: it watches four surfaces — userland ntdll inline hooks, kernel callbacks (Ps/Cm/Ob routines), ETW telemetry (notably the Threat-Intelligence provider), and AMSI scans — and every one of them can be reverse engineered with IDA/windbg and then neutralized with a matching technique. No single bypass is enough (unhooking doesn't stop ETW; an AMSI patch doesn't stop syscall hooks), and the order matters: blind the telemetry before you touch memory the telemetry watches.