windows-av-evasion

This skill is internally consistent but purposefully equips an AI agent to bypass Windows security controls and execute offensive evasion techniques. The main risk is not deception or credential theft; it is that the skill materially enables stealthy intrusion behavior and chains into other attack skills, so it should be classified as high-risk and suspicious rather than confirmed malware.

This code fragment is explicitly and comprehensively about bypassing Windows AMSI and evading security tooling. It includes high-risk malware tradecraft: direct in-process memory patching of AmsiScanBuffer (VirtualProtect/Marshal.Copy), reflection-based manipulation of AMSI internal state, PowerShell loader/evasion patterns (including IEX + remote download), COM hijack via registry redirect, and hardware breakpoint interception to alter scan outcomes. These are strongly indicative of malicious behavior (defense evasion and payload execution).