Infiltr8: Red-Book

Infiltr8: Red-Book

Defense Evasion

Endpoint Detection Respons (EDR) Bypass

Bring Your Own Vulnerable Driver (BYOVD)Safe Mode With Networking Windows Defender Application Control (WDAC): Killing EDR Load Unsigned Drivers Minifilter Altitude Hypervisor Code Integrity (HVCI) Disallowed Images Windows Filtering Platform (WFP)Userland Hooking Bypass

Living Off The Land

Signature Evasion

AppLocker Bypass Mark-of-the-Web (MotW) Bypass PowerShell Constrained Language Mode (CLM) Bypass Kill Windows Defender

Virtualization-based security (VBS) Bypass

Sandbox Evasion

Privilege Escalation

Credential Access

Lateral Movement

Red-TeamingDefense Evasion Endpoint Detection Respons (EDR) Bypass

Work in progress

This page is incomplete — content may be missing or unverified.

Minifilter Altitude

https://tierzerosecurity.co.nz/2024/03/27/blind-edr.html

Load Unsigned Drivers

Previous Page

Hypervisor Code Integrity (HVCI) Disallowed Images

Next Page