[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F5ZRXPRH932REDVT1KB2W2":3,"skill-same:01M6F5ZRXPRH932REDVT1KB2W2":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":27,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6F5ZRXPRH932REDVT1KB2W2","edr-bypass-re",null,"Review EDR telemetry and known defense-evasion classes using offline evidence and controlled defensive coverage assessments.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-edr-bypass-re\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"edr bypass re","re","edr","coverage","2026","blob","reverse","offensive","defensive","main","community","evidence","review","evasion","defense-evasion","defense","https","offline","license","telemetry","github","2026-11-10 10:12:30",false,"---\nname: edr-bypass-re\ndescription: \"Review EDR telemetry and known defense-evasion classes using offline evidence and controlled defensive coverage assessments.\"\nrisk: offensive\nsource: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\"\nsource_repo: \"zhaoxuya520\u002Freverse-skill\"\nsource_type: community\ndate_added: \"2026-08-25\"\nlicense: \"MIT\"\nlicense_source: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE\"\n---\n# EDR telemetry coverage review\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT). This catalog revision replaces operational blinding, implant deployment, and evidence-erasure recipes with defensive review procedures. The skill ID is retained for compatibility.\n\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n## Mandatory confirmation gate\n\nBefore each live assessment command, collect the exact target URL, IP, account, or resource, confirmation of written owner authorization, and permitted scope. Show the exact command and expected effect. Wait for explicit confirmation in the current conversation before executing that action. Offline evidence review can proceed within the already authorized task; this guide does not supply operational evasion commands.\n\n## When to Use\n\n- Analyze authorized, previously collected EDR evidence or an offline forensic image.\n- Design a coverage assessment with the system owner and SOC in an isolated lab.\n- Explain differences between user-mode instrumentation, kernel callbacks, ETW and AMSI without assuming a particular vendor implementation.\n\n## Procedure\n\n1. Define the asset, authorized evidence sources, product\u002Fbuild, Windows build, configuration, collection interval and retention restrictions. Installation or configuration changes need separate authorization; reading this skill does not grant it.\n2. Preserve the original evidence and record hashes, acquisition time and tool versions. Process dumps can contain credentials and personal data; keep them in restricted storage and redact exported findings.\n3. Compare observations with an architecture- and build-matched baseline. Disk and memory images have different layouts and relocations; a byte difference or leading jump alone is not proof of an EDR hook or compromise.\n4. Use the bundled references to classify observations. Treat process\u002Fdriver names as clues, not an authoritative product inventory. Confirm ownership and version through signed metadata and the owner's management console.\n5. For coverage tests, agree on benign vendor-supported test signals, expected event sources, correlation IDs and a bounded window before execution. Keep protection and logging enabled. Correlate endpoint, collector and SOC records; distinguish collection failures, filtering, retention and alert-rule gaps.\n6. Report each hypothesis with evidence and uncertainty. A missing alert does not establish successful evasion, and a single event does not establish complete detection coverage. Restore any separately approved lab configuration and verify normal telemetry delivery; preserve evidence rather than deleting logs.\n\n## Examples\n\nA process event is absent from the SIEM: first check whether the event type was enabled, the host clock and collector were healthy, and the query covered the correct host\u002Ftime range. Record an unresolved collection gap rather than concluding the sensor was bypassed.\n\nA memory image differs from the matching on-disk module: document the acquisition method, image layout and module signature\u002Fversion before attributing the difference. Do not patch the running process to test that attribution.\n\n## References\n\n- [Hook evidence review](references\u002Fhook-survey.md)\n- [Unhook and syscall technique classification](references\u002Funhook-techniques.md)\n- [Telemetry integrity review](references\u002Ftelemetry-blinding.md)\n\n## Limitations\n\n- This is a static review and planning guide, not a bypass implementation or a vendor effectiveness benchmark.\n- Undocumented internals and product behavior vary by build and configuration. No universal hook inventory, syscall number or safe bypass sequence is asserted.\n- The upstream bootstrap script, tool index and broader attack-chain routes are not bundled. Do not invent their paths or execute substitute downloads.\n","# EDR telemetry coverage review\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT). This catalog revision replaces operational blinding, implant deployment, and evidence-erasure recipes with defensive review procedures. The skill ID is retained for compatibility.\n\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n## Mandatory confirmation gate\n\nBefore each live assessment command, collect the exact target URL, IP, account, or resource, confirmation of written owner authorization, and permitted scope. Show the exact command and expected effect. Wait for explicit confirmation in the current conversation before executing that action. Offline evidence review can proceed within the already authorized task; this guide does not supply operational evasion commands.\n\n## When to Use\n\n- Analyze authorized, previously collected EDR evidence or an offline forensic image.\n- Design a coverage assessment with the system owner and SOC in an isolated lab.\n- Explain differences between user-mode instrumentation, kernel callbacks, ETW and AMSI without assuming a particular vendor implementation.\n\n## Procedure\n\n1. Define the asset, authorized evidence sources, product\u002Fbuild, Windows build, configuration, collection interval and retention restrictions. Installation or configuration changes need separate authorization; reading this skill does not grant it.\n2. Preserve the original evidence and record hashes, acquisition time and tool versions. Process dumps can contain credentials and personal data; keep them in restricted storage and redact exported findings.\n3. Compare observations with an architecture- and build-matched baseline. Disk and memory images have different layouts and relocations; a byte difference or leading jump alone is not proof of an EDR hook or compromise.\n4. Use the bundled references to classify observations. Treat process\u002Fdriver names as clues, not an authoritative product inventory. Confirm ownership and version through signed metadata and the owner's management console.\n5. For coverage tests, agree on benign vendor-supported test signals, expected event sources, correlation IDs and a bounded window before execution. Keep protection and logging enabled. Correlate endpoint, collector and SOC records; distinguish collection failures, filtering, retention and alert-rule gaps.\n6. Report each hypothesis with evidence and uncertainty. A missing alert does not establish successful evasion, and a single event does not establish complete detection coverage. Restore any separately approved lab configuration and verify normal telemetry delivery; preserve evidence rather than deleting logs.\n\n## Examples\n\nA process event is absent from the SIEM: first check whether the event type was enabled, the host clock and collector were healthy, and the query covered the correct host\u002Ftime range. Record an unresolved collection gap rather than concluding the sensor was bypassed.\n\nA memory image differs from the matching on-disk module: document the acquisition method, image layout and module signature\u002Fversion before attributing the difference. Do not patch the running process to test that attribution.\n\n## References\n\n- [Hook evidence review](references\u002Fhook-survey.md)\n- [Unhook and syscall technique classification](references\u002Funhook-techniques.md)\n- [Telemetry integrity review](references\u002Ftelemetry-blinding.md)\n\n## Limitations\n\n- This is a static review and planning guide, not a bypass implementation or a vendor effectiveness benchmark.\n- Undocumented internals and product behavior vary by build and configuration. No universal hook inventory, syscall number or safe bypass sequence is asserted.\n- The upstream bootstrap script, tool index and broader attack-chain routes are not bundled. Do not invent their paths or execute substitute downloads.\n",{"name":5,"risk":25,"source":44,"license":14,"date_added":45,"description":7,"source_repo":46,"source_type":28,"license_source":47},"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill","2026-08-25","zhaoxuya520\u002Freverse-skill","https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-edr-bypass-re",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-10 14:20:15",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add boisenoise\u002Fskills-collections --skill edr-bypass-re",{"tool":60,"command":61},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill edr-bypass-re",{"tool":63,"command":64},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill edr-bypass-re","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-edr-bypass-re\u002FSKILL.md",true,[68,74,78],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fhook-survey.md","REFERENCE","参考文档",2327,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-edr-bypass-re\u002Freferences\u002Fhook-survey.md",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Ftelemetry-blinding.md",2843,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-edr-bypass-re\u002Freferences\u002Ftelemetry-blinding.md",{"path":79,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Funhook-techniques.md",2210,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-edr-bypass-re\u002Freferences\u002Funhook-techniques.md",[83,112,137,161,180,203],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":88,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":39},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,22],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","only","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":116,"sourceHtmlUrl":117,"categories":118,"keywords":124,"publishedAt":39},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[119],{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[114,125,126,38,95,96,36,100,127,128,129,130,131,132,133,107,134,135,136,23,22],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":141,"sourceHtmlUrl":142,"categories":143,"keywords":149,"publishedAt":39},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[144],{"categoryNo":145,"categoryName":146,"taxonomyType":147,"taxonomyTypeDesc":148},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[139,38,95,36,34,150,151,152,29,153,107,154,155,156,135,157,158,159,160,23,114,22],"email","enrichment","business","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":165,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":39},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[169,170,171,38,95,36,172,173,34,174,127,175,176,177,29,107,178,179,23,114,22],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":184,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":39},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[188,189,38,190,95,191,36,192,193,194,195,196,107,197,198,199,200,201,202,23],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":87,"licenseFileUrl":207,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":39},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[211,212,213,38,95,36,214,215,152,216,217,107,218,219,220,221,222,223,224,23],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]