EDR495 SyscallRevenant: Clean Indirect Syscalls with Trap-Flag Tracing
Clean indirect syscalls on Windows x64. It single-steps a hooked ntdll stub with the CPU trap flag to learn the live System…
oxfemale·
Oct 19·
31 min
·495
// EDR Evasion
13 postsEDR495 
AI Agents735 Bypassing EDR with Local AI
Eddie Zhang / Project Black: Claude refuses an LSASS dumper; DeepSeek builds one EDR still catches; uncensored Qwen 3.8 27B on two…
oxfemale·
Oct 2·
12 min
·735
EDR Evasion789 Direct $MFT Parsing: Reading NTFS Below the Monitored API Layer
Direct $MFT parsing walks the on-disk NTFS Master File Table through a raw volume handle, producing a full inventory of files, deleted…
oxfemale·
Jul 17·
28 min
·789
Cybersecurity971 Process Parameter Poisoning: EDR Evasion via Windows Process Startup Parameters
Process Parameter Poisoning (P3) is a stealthy process injection technique that abuses Windows startup parameters to transfer and execute code in a…
oxfemale·
Jul 9·
16 min
·971
EDR Evasion601 Callback Hell: Abusing Callbacks, Tail-Calls, and Proxy Frames to Obfuscate the Stack
klezVirus introduces frame swapping — a technique that hides Windows callback frames from EDR call-stack inspectors while preserving return value recovery. Building…
oxfemale·
Jul 6·
13 min
·601
EDR Evasion614 FUD Shellcode Stagers in Python: String Reversal, NT APIs and IAT Walking to Bypass EDR
Two Python shellcode stagers from g3tsyst3m that hit 0/63 on VirusTotal — Variant #1 uses string-reversed NT APIs (NtAllocateVirtualMemory, NtCreateThreadEx) plus RWX…
oxfemale·
Jun 23·
20 min
·614
EDR Evasion660 LACUNA Chain: Ghost Frames Defeat Every Layer of EDR Call-Stack Detection
Mohamed Alzhrani's LACUNA Chain combines BYOUD-Gap, the ETW-Ti APC window, win32u's 1,242 NOP gaps, ntdll/kernelbase ghost functions, BYOUD-MF machine-frame RSP teleport, BYOUD-RT…
oxfemale·
Jun 21·
30 min
·660
EDR Evasion578 tabby — A Minimal Position-Independent Windows x64 Shellcode Framework, Built Entirely on Linux
cocomelonc’s tabby is a tiny teaching framework for writing position-independent Windows x64 shellcode in C, with indirect NT syscalls and no IAT,…
oxfemale·
Jun 15·
23 min
·578
EDR Evasion352 Centurion: A Virtualized Loader and the “Bring Your Own Execution Environment” Model
Praetorian’s Centurion is a virtualized loader built around a custom x86-64-inspired ISA and freestanding C runtime, where the PE loader, TLS stack…
oxfemale·
Jun 13·
21 min
·352
EDR Evasion313 BusyWork: Replacing Sleep with Real Work to Break Behavioral Detection
BusyWork is a Rust library that swaps every sleep() call for a randomized cocktail of real work across seven categories — compute,…
oxfemale·
Jun 9·
13 min
·313
APC399 Gargoyle, A Decade Later: Josh Lospinoso’s Memory-Scanning Evasion Idea, Refreshed for 2026
The 2017 Windows research demo that flipped page protections so a shellcode region was non-executable at scan time and executable only during…
oxfemale·
May 27·
13 min
·399
Bypassing501 Callback Hell: Abusing Callbacks, Tail Calls, and Proxy Frames to Obfuscate the Stack
A walkthrough of klezVirus' "Callback hell" — a technique that hides callback frames from stack inspectors by combining tail-calls, forward and backward…
oxfemale·
May 24·
16 min
·501