offensive-edr-evasion

EDR evasion offensive checklist: hook unhooking (user/kernel), direct syscalls, PPID spoofing, process injection variants, AMSI bypass, ETW patching, memory encryption, and behavior-based evasion. Use when planning EDR bypass during red team engagements or researching AV/EDR evasion techniques. Trigger phrases: EDR evasion, EDR bypass, hook unhooking, direc…

Independent GitHub snapshot · Automated classification · Original documentation governs