Infiltr8: Red-Book

Infiltr8: Red-Book

Defense Evasion

Endpoint Detection Respons (EDR) Bypass

Bring Your Own Vulnerable Driver (BYOVD)Safe Mode With Networking Windows Defender Application Control (WDAC): Killing EDR Load Unsigned Drivers Minifilter Altitude Hypervisor Code Integrity (HVCI) Disallowed Images Windows Filtering Platform (WFP)Userland Hooking Bypass

Living Off The Land

Signature Evasion

AppLocker Bypass Mark-of-the-Web (MotW) Bypass PowerShell Constrained Language Mode (CLM) Bypass Kill Windows Defender

Virtualization-based security (VBS) Bypass

Sandbox Evasion

Privilege Escalation

Credential Access

Lateral Movement

Red-TeamingDefense Evasion Endpoint Detection Respons (EDR) Bypass

Work in progress

This page is incomplete — content may be missing or unverified.

Windows Filtering Platform (WFP)

https://github.com/netero1010/EDRSilencer
https://learn.microsoft.com/en-us/windows-hardware/drivers/network/introduction-to-windows-filtering-platform-callout-drivers
https://github.com/dsnezhkov/shutter

Hypervisor Code Integrity (HVCI) Disallowed Images

Previous Page

Userland Hooking Bypass

Next Page