--- name: edr-bypass-re description: "Review EDR telemetry and known defense-evasion classes using offline evidence and controlled defensive coverage assessments." risk: offensive source: "https://github.com/zhaoxuya520/reverse-skill" source_repo: "zhaoxuya520/reverse-skill" source_type: community date_added: "2026-08-25" license: "MIT" license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE" --- # EDR telemetry coverage review > Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT). This catalog revision replaces operational blinding, implant deployment, and evidence-erasure recipes with defensive review procedures. The skill ID is retained for compatibility. > **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. ## Mandatory confirmation gate Before each live assessment command, collect the exact target URL, IP, account, or resource, confirmation of written owner authorization, and permitted scope. Show the exact command and expected effect. Wait for explicit confirmation in the current conversation before executing that action. Offline evidence review can proceed within the already authorized task; this guide does not supply operational evasion commands. ## When to Use - Analyze authorized, previously collected EDR evidence or an offline forensic image. - Design a coverage assessment with the system owner and SOC in an isolated lab. - Explain differences between user-mode instrumentation, kernel callbacks, ETW and AMSI without assuming a particular vendor implementation. ## Procedure 1. Define the asset, authorized evidence sources, product/build, Windows build, configuration, collection interval and retention restrictions. Installation or configuration changes need separate authorization; reading this skill does not grant it. 2. Preserve the original evidence and record hashes, acquisition time and tool versions. Process dumps can contain credentials and personal data; keep them in restricted storage and redact exported findings. 3. Compare observations with an architecture- and build-matched baseline. Disk and memory images have different layouts and relocations; a byte difference or leading jump alone is not proof of an EDR hook or compromise. 4. Use the bundled references to classify observations. Treat process/driver names as clues, not an authoritative product inventory. Confirm ownership and version through signed metadata and the owner's management console. 5. For coverage tests, agree on benign vendor-supported test signals, expected event sources, correlation IDs and a bounded window before execution. Keep protection and logging enabled. Correlate endpoint, collector and SOC records; distinguish collection failures, filtering, retention and alert-rule gaps. 6. Report each hypothesis with evidence and uncertainty. A missing alert does not establish successful evasion, and a single event does not establish complete detection coverage. Restore any separately approved lab configuration and verify normal telemetry delivery; preserve evidence rather than deleting logs. ## Examples A process event is absent from the SIEM: first check whether the event type was enabled, the host clock and collector were healthy, and the query covered the correct host/time range. Record an unresolved collection gap rather than concluding the sensor was bypassed. A memory image differs from the matching on-disk module: document the acquisition method, image layout and module signature/version before attributing the difference. Do not patch the running process to test that attribution. ## References - [Hook evidence review](references/hook-survey.md) - [Unhook and syscall technique classification](references/unhook-techniques.md) - [Telemetry integrity review](references/telemetry-blinding.md) ## Limitations - This is a static review and planning guide, not a bypass implementation or a vendor effectiveness benchmark. - Undocumented internals and product behavior vary by build and configuration. No universal hook inventory, syscall number or safe bypass sequence is asserted. - The upstream bootstrap script, tool index and broader attack-chain routes are not bundled. Do not invent their paths or execute substitute downloads. --- Source attribution: zhaoxuya520/reverse-skill contributors, via Agentic Awesome Skills Original project: https://github.com/zhaoxuya520/reverse-skill License: MIT + CC-BY-4.0 License information: https://creativecommons.org/licenses/by/4.0/ Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 zhaoxuya520 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: zhaoxuya520/reverse-skill contributors, via Agentic Awesome Skills Original project: https://github.com/zhaoxuya520/reverse-skill Attribution basis: Recorded upstream repository Fields of work: Development & Engineering Roles: Security Engineer Specialties: Specialty not specified Tools: Tool not specified Country applicability: Country not specified Classification basis: Dave AI task review of package instructions and description Instruction SHA-256: d7865a608dc04dceccaf7895297c5e501da07e595357d7b680b93553fcd3371b Metadata reviewed: 2026-10-27 This metadata supersedes earlier Mega AI Hub catalog attribution. Original instruction and supporting files are preserved.