EDR telemetry coverage review

Adapted from zhaoxuya520/reverse-skill (MIT). This catalog revision replaces operational blinding, implant deployment, and evidence-erasure recipes with defensive review procedures. The skill ID is retained for compatibility.

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate

Before each live assessment command, collect the exact target URL, IP, account, or resource, confirmation of written owner authorization, and permitted scope. Show the exact command and expected effect. Wait for explicit confirmation in the current conversation before executing that action. Offline evidence review can proceed within the already authorized task; this guide does not supply operational evasion commands.

When to Use

• Analyze authorized, previously collected EDR evidence or an offline forensic image.
• Design a coverage assessment with the system owner and SOC in an isolated lab.
• Explain differences between user-mode instrumentation, kernel callbacks, ETW and AMSI without assuming a particular vendor implementation.

Procedure