[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P274KX9X0ABHAH9BBMMZP9":3,"skill-same:01M6P274KX9X0ABHAH9BBMMZP9":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":30,"commitSha":48,"skillDirectory":49,"forksCount":13,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":66},"01M6P274KX9X0ABHAH9BBMMZP9","edr-bypass-re",null,"Reverse engineer EDR internals (user-mode hook tables, ETW, AMSI) and study bypass techniques such as direct syscalls, Hell's Gate, and call-stack spoofing. Lab-only red-team research.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fedr-bypass-re\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"edr","edr bypass re","re","call","techniques","reverse","mode","lab","as","reverse engineer","study","license","main","community","engineer","only","stack","team","amsi","red-team","2026-11-10 10:12:30",false,"---\nname: edr-bypass-re\ndescription: \"Reverse engineer EDR internals (user-mode hook tables, ETW, AMSI) and study bypass techniques such as direct syscalls, Hell's Gate, and call-stack spoofing. Lab-only red-team research.\"\nrisk: offensive\nsource: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\"\nsource_repo: \"zhaoxuya520\u002Freverse-skill\"\nsource_type: community\ndate_added: \"2026-08-25\"\nlicense: \"MIT\"\nlicense_source: \"https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE\"\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## When to Use\n\n- Studying EDR telemetry surfaces in an authorized red-team lab.\n- Evaluating detection coverage against known bypass technique classes.\n\n## 适用范围\n\n红队 \u002F 对抗模拟在已获授权的目标主机投递 implant 并躲避现代 EDR 时使用本 skill。\n\n1. **红队 \u002F Purple team \u002F 对抗演练** — 客户希望评估 SOC 与 EDR 的真实检测能力\n2. **自研 implant \u002F C2 框架研发** — 开发针对自家产品测试的载荷，需要绕过自家或目标 EDR\n3. **EDR 产品评估** — 在合规边界已确认的前提下，客观评测某款 EDR 的检测覆盖\n4. **CTF \u002F 攻防演练的 Windows 端突破** — 比赛中需要在加固主机上稳定执行\n\n**不适用场景**：\n\n- 杀毒厂商对自家产品做完整 RE 给客户出商业评估报告（找厂商正式合作）\n- 未授权目标的免杀对抗（违法）\n- 普通病毒木马的免杀（本 skill 关注红队 OPSEC，不教恶意代码写法）\n\n### 与其他 skill 的分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 全链路攻防（从外网打到域控） | `attack-chain\u002F` |\n| 内网横向 \u002F AD 攻击 | `pentest-tools\u002Fnetwork-attack-defense.md` |\n| 在某个特定主机上要过 EDR 投递 implant | **本 skill** |\n| 单纯静态免杀（混淆 \u002F 加壳） | `malware-analysis\u002F`（反向视角） |\n\n`attack-chain` 关注完整 kill chain，本 skill 只聚焦 **EDR 这一个对手** 的内部机制和针对性绕法。\n\n## 核心原理\n\n```text\nEDR 的四个主要监控面               红队的对策\n─────────────────────              ─────────────────────\n用户态 ntdll hook       ◄──►   unhook (Peruns Fart \u002F fresh ntdll)\n                                  间接 syscall \u002F Hell's Gate\n                                  hardware breakpoint Blindside\n\nkernel callback         ◄──►   call stack spoof\n(Ps\u002FCm\u002FOb 系列)                   走合法触发链（不直接绕，配合上游隐身）\n\nETW telemetry           ◄──►   EtwEventWrite patch\n(Microsoft-Windows-Threat-          NtTraceControl 关 provider\n Intelligence 等)                  AmsiContext 同步处理\n\nAMSI 扫描               ◄──►   AmsiScanBuffer patch (mov eax,0x80070057; ret)\n(amsi.dll)                       hardware breakpoint 旁路\n                                  reflective 加载副本 amsi.dll\n```\n\n关键认知：\n\n- **EDR 不是黑盒** — 关键 hook \u002F callback \u002F provider 都能用 IDA + windbg 逆出来\n- **绕过技术要组合使用** — 单独一个 unhook 解决不了 ETW 告警，单独 AMSI patch 解决不了 syscall hook\n- **顺序很重要** — 先 ETW patch → 再 AMSI patch → 再 unhook；顺序错了 EDR 先收到 unhook 告警\n- **现代 EDR 已经把 ETW + kernel callback 当主战场**，单纯用户态 unhook 早已不够\n\n## 工作流\n\n### Step 1：识别目标主机的 EDR\n\n```powershell\n# 列出常见 EDR \u002F AV 驱动\nGet-Service | Where-Object {$_.Name -match 'CSAgent|SentinelAgent|elasticendpoint|esets|ekrn|MsMpEng|wdsvc|cyserver|sysmon|aswbidsagent'}\n\n# 列出加载的 minifilter\nfltmc filters\n\n# 列出已注册的内核 callback（需 windbg + 内核调试 \u002F 或用 PChunter \u002F DRVHV）\n# !object \\Callback\n# !pnpcallback \u002F Process \u002F Thread \u002F Image\n```\n\nEDR 指纹表见 `references\u002Fhook-survey.md` 顶部。\n\n### Step 2：从 EDR DLL 提 hook 表\n\n1. attach 到一个被注入 EDR 用户态组件的进程（任何已落地进程）\n2. 在 windbg 中 dump 当前 `ntdll.dll` 的 `.text` 段\n3. 与磁盘上干净的 `C:\\Windows\\System32\\ntdll.dll` 做 diff\n4. 不一致的地方就是 hook 点\n\n或者直接用 `pe-sieve`：\n\n```powershell\npe-sieve64.exe \u002Fpid 1234 \u002Fshellc 3 \u002Fmodules 3 \u002Fdir hooks_dump\n```\n\n详细方法见 `references\u002Fhook-survey.md`。\n\n### Step 3：选绕过技术组合\n\n| 防御点 | 推荐绕法 |\n|--------|---------|\n| ntdll inline hook | indirect syscall + 动态 SSN (Halo's Gate) |\n| ETW-TI provider | EtwEventWrite head patch |\n| AMSI（PowerShell \u002F .NET） | AmsiScanBuffer patch 或 HWBP |\n| kernel callback | call stack spoof + 走 legit gadget |\n| Sysmon ProcessCreate | PPID spoof + unbacked memory |\n\n### Step 4：在 implant 中实现\n\n代码骨架见 `references\u002Funhook-techniques.md` 与 `references\u002Ftelemetry-blinding.md`。\n\n### Step 5：本地 sandbox 验证\n\n```powershell\n# 在隔离环境部署目标 EDR 试用版（Defender 默认即可起步）\n# 启用 Sysmon + olaf-config\nsysmon64.exe -i sysmonconfig.xml\n\n# 跑 implant，看是否触发以下告警源：\n#   - Defender AMSI\n#   - ETW-TI\n#   - Sysmon Event ID 1\u002F7\u002F8\u002F10\n#   - EDR 控制台\n```\n\n### Step 6：投递\n\n- 文件落地路径用合法软件目录\n- PPID spoof 到 explorer.exe\n- 配合 `attack-chain` 中的 initial access 节\n\n## 典型场景\n\n### 场景 1：投递 cobalt-strike-alike beacon 过 Defender + Sysmon\n\n```text\n目标：Windows 11 Enterprise + Defender (云查杀开) + Sysmon (olaf 配置)\n要求：beacon 落地后能 callback 且不触发任何告警\n\n组合拳：\n  1. shellcode 加密存储，运行时解密\n  2. AMSI patch（如果走 PowerShell 投递）\n  3. EtwEventWrite patch（消 ETW-TI）\n  4. 间接 syscall + Halo's Gate（消 ntdll hook 告警）\n  5. PPID spoof 到 explorer.exe\n  6. sleep 阶段用 Ekko \u002F Foliage 加密自身内存\n```\n\n### 场景 2：在已落地的低权限 shell 上做 EDR sleep mask\n\n```text\n前置：已经通过 phishing 拿到 medium IL shell，EDR 正在监控\n风险：长时间驻留容易被内存扫描发现 beacon 特征\n\n解法：\n  1. 不再申请新 RWX 内存\n  2. sleep 期间用 Ekko：\n       - WaitForSingleObjectEx + CreateTimerQueueTimer\n       - 在定时器里加密自身 .text + 把堆栈刷成全 0\n  3. wake 时用 ROP 还原\n  4. 配合 call stack spoof 让 RtlCaptureStackBackTrace 看不到信标地址\n```\n\n## 按需自举（On-Demand Bootstrap）\n\n### 工具依赖\n\n| 工具 | 用途 | 可自动安装 |\n|------|------|-----------|\n| pe-sieve | 检测进程中的 hook \u002F 注入 | ✓ |\n| API Monitor v2 | 动态观察 API 调用与 hook | 半自动（手动下载） |\n| SysWhispers3 | 生成直接 \u002F 间接 syscall stub | ✓（git clone + python） |\n| Hell's Gate POC | 动态 SSN 解析参考实现 | ✓（git clone） |\n| windbg + IDA | 静态逆 EDR DLL \u002F 内核 callback | ✗（自己装） |\n| Sysmon + olaf config | 本地验证环境 | ✓ |\n\n### 自举命令\n\n```powershell\npowershell -NoProfile -ExecutionPolicy Bypass -File \"<SKILL_ROOT>\\skills\\scripts\\bootstrap-reverse.ps1\" -Capability @('pe-sieve','syswhispers3','sysmon') -StartServices\n```\n\n## 路由上下文\n\n**上游入口**：\n\n- `reverse-engineering\u002F` — 需要先理解 EDR DLL \u002F 驱动的实现\n- `attack-chain\u002F` — 决定在 kill chain 的哪个阶段引入本 skill\n\n**同级关联**：\n\n- `pentest-tools\u002Fnetwork-attack-defense.md` — 内网横向时如何与本 skill 联动\n- `malware-analysis\u002F` — 反向视角，看检测方怎么写规则\n- `field-journal\u002F` — 每次实战后回写经验\n\n**下游交付**：\n\n- 生成报告时引用 MITRE ATT&CK **T1562 (Impair Defenses)**、T1562.001 (Disable or Modify Tools)、T1562.006 (Indicator Blocking)、T1055 (Process Injection)、T1027 (Obfuscated Files or Information)\n\n## 法律边界声明\n\n- 仅限合法授权的红队 \u002F 对抗演练 \u002F 自有产品测试\n- 操作前必须取得书面授权（SoW \u002F 测试合同 \u002F SRC 范围说明）\n- 不得用于未授权目标，不得超出授权范围\n- 发现高危问题立即向客户报告，遵循负责任披露\n- 所有报告中真实目标信息必须脱敏（IP \u002F 主机名 \u002F 域名 \u002F 凭证占位）\n\n## 参考资料\n\n- 详细 hook 调研：`references\u002Fhook-survey.md`\n- unhook \u002F syscall 技术：`references\u002Funhook-techniques.md`\n- ETW \u002F AMSI \u002F 反取证：`references\u002Ftelemetry-blinding.md`\n- MITRE ATT&CK T1562：\u003Chttps:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1562\u002F>\n\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- Lab environment only: deploying bypasses against monitored production systems is out of scope and illegal without authorization.\n- Technique descriptions age quickly as EDR vendors adapt.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## When to Use\n\n- Studying EDR telemetry surfaces in an authorized red-team lab.\n- Evaluating detection coverage against known bypass technique classes.\n\n## 适用范围\n\n红队 \u002F 对抗模拟在已获授权的目标主机投递 implant 并躲避现代 EDR 时使用本 skill。\n\n1. **红队 \u002F Purple team \u002F 对抗演练** — 客户希望评估 SOC 与 EDR 的真实检测能力\n2. **自研 implant \u002F C2 框架研发** — 开发针对自家产品测试的载荷，需要绕过自家或目标 EDR\n3. **EDR 产品评估** — 在合规边界已确认的前提下，客观评测某款 EDR 的检测覆盖\n4. **CTF \u002F 攻防演练的 Windows 端突破** — 比赛中需要在加固主机上稳定执行\n\n**不适用场景**：\n\n- 杀毒厂商对自家产品做完整 RE 给客户出商业评估报告（找厂商正式合作）\n- 未授权目标的免杀对抗（违法）\n- 普通病毒木马的免杀（本 skill 关注红队 OPSEC，不教恶意代码写法）\n\n### 与其他 skill 的分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 全链路攻防（从外网打到域控） | `attack-chain\u002F` |\n| 内网横向 \u002F AD 攻击 | `pentest-tools\u002Fnetwork-attack-defense.md` |\n| 在某个特定主机上要过 EDR 投递 implant | **本 skill** |\n| 单纯静态免杀（混淆 \u002F 加壳） | `malware-analysis\u002F`（反向视角） |\n\n`attack-chain` 关注完整 kill chain，本 skill 只聚焦 **EDR 这一个对手** 的内部机制和针对性绕法。\n\n## 核心原理\n\n```text\nEDR 的四个主要监控面               红队的对策\n─────────────────────              ─────────────────────\n用户态 ntdll hook       ◄──►   unhook (Peruns Fart \u002F fresh ntdll)\n                                  间接 syscall \u002F Hell's Gate\n                                  hardware breakpoint Blindside\n\nkernel callback         ◄──►   call stack spoof\n(Ps\u002FCm\u002FOb 系列)                   走合法触发链（不直接绕，配合上游隐身）\n\nETW telemetry           ◄──►   EtwEventWrite patch\n(Microsoft-Windows-Threat-          NtTraceControl 关 provider\n Intelligence 等)                  AmsiContext 同步处理\n\nAMSI 扫描               ◄──►   AmsiScanBuffer patch (mov eax,0x80070057; ret)\n(amsi.dll)                       hardware breakpoint 旁路\n                                  reflective 加载副本 amsi.dll\n```\n\n关键认知：\n\n- **EDR 不是黑盒** — 关键 hook \u002F callback \u002F provider 都能用 IDA + windbg 逆出来\n- **绕过技术要组合使用** — 单独一个 unhook 解决不了 ETW 告警，单独 AMSI patch 解决不了 syscall hook\n- **顺序很重要** — 先 ETW patch → 再 AMSI patch → 再 unhook；顺序错了 EDR 先收到 unhook 告警\n- **现代 EDR 已经把 ETW + kernel callback 当主战场**，单纯用户态 unhook 早已不够\n\n## 工作流\n\n### Step 1：识别目标主机的 EDR\n\n```powershell\n# 列出常见 EDR \u002F AV 驱动\nGet-Service | Where-Object {$_.Name -match 'CSAgent|SentinelAgent|elasticendpoint|esets|ekrn|MsMpEng|wdsvc|cyserver|sysmon|aswbidsagent'}\n\n# 列出加载的 minifilter\nfltmc filters\n\n# 列出已注册的内核 callback（需 windbg + 内核调试 \u002F 或用 PChunter \u002F DRVHV）\n# !object \\Callback\n# !pnpcallback \u002F Process \u002F Thread \u002F Image\n```\n\nEDR 指纹表见 `references\u002Fhook-survey.md` 顶部。\n\n### Step 2：从 EDR DLL 提 hook 表\n\n1. attach 到一个被注入 EDR 用户态组件的进程（任何已落地进程）\n2. 在 windbg 中 dump 当前 `ntdll.dll` 的 `.text` 段\n3. 与磁盘上干净的 `C:\\Windows\\System32\\ntdll.dll` 做 diff\n4. 不一致的地方就是 hook 点\n\n或者直接用 `pe-sieve`：\n\n```powershell\npe-sieve64.exe \u002Fpid 1234 \u002Fshellc 3 \u002Fmodules 3 \u002Fdir hooks_dump\n```\n\n详细方法见 `references\u002Fhook-survey.md`。\n\n### Step 3：选绕过技术组合\n\n| 防御点 | 推荐绕法 |\n|--------|---------|\n| ntdll inline hook | indirect syscall + 动态 SSN (Halo's Gate) |\n| ETW-TI provider | EtwEventWrite head patch |\n| AMSI（PowerShell \u002F .NET） | AmsiScanBuffer patch 或 HWBP |\n| kernel callback | call stack spoof + 走 legit gadget |\n| Sysmon ProcessCreate | PPID spoof + unbacked memory |\n\n### Step 4：在 implant 中实现\n\n代码骨架见 `references\u002Funhook-techniques.md` 与 `references\u002Ftelemetry-blinding.md`。\n\n### Step 5：本地 sandbox 验证\n\n```powershell\n# 在隔离环境部署目标 EDR 试用版（Defender 默认即可起步）\n# 启用 Sysmon + olaf-config\nsysmon64.exe -i sysmonconfig.xml\n\n# 跑 implant，看是否触发以下告警源：\n#   - Defender AMSI\n#   - ETW-TI\n#   - Sysmon Event ID 1\u002F7\u002F8\u002F10\n#   - EDR 控制台\n```\n\n### Step 6：投递\n\n- 文件落地路径用合法软件目录\n- PPID spoof 到 explorer.exe\n- 配合 `attack-chain` 中的 initial access 节\n\n## 典型场景\n\n### 场景 1：投递 cobalt-strike-alike beacon 过 Defender + Sysmon\n\n```text\n目标：Windows 11 Enterprise + Defender (云查杀开) + Sysmon (olaf 配置)\n要求：beacon 落地后能 callback 且不触发任何告警\n\n组合拳：\n  1. shellcode 加密存储，运行时解密\n  2. AMSI patch（如果走 PowerShell 投递）\n  3. EtwEventWrite patch（消 ETW-TI）\n  4. 间接 syscall + Halo's Gate（消 ntdll hook 告警）\n  5. PPID spoof 到 explorer.exe\n  6. sleep 阶段用 Ekko \u002F Foliage 加密自身内存\n```\n\n### 场景 2：在已落地的低权限 shell 上做 EDR sleep mask\n\n```text\n前置：已经通过 phishing 拿到 medium IL shell，EDR 正在监控\n风险：长时间驻留容易被内存扫描发现 beacon 特征\n\n解法：\n  1. 不再申请新 RWX 内存\n  2. sleep 期间用 Ekko：\n       - WaitForSingleObjectEx + CreateTimerQueueTimer\n       - 在定时器里加密自身 .text + 把堆栈刷成全 0\n  3. wake 时用 ROP 还原\n  4. 配合 call stack spoof 让 RtlCaptureStackBackTrace 看不到信标地址\n```\n\n## 按需自举（On-Demand Bootstrap）\n\n### 工具依赖\n\n| 工具 | 用途 | 可自动安装 |\n|------|------|-----------|\n| pe-sieve | 检测进程中的 hook \u002F 注入 | ✓ |\n| API Monitor v2 | 动态观察 API 调用与 hook | 半自动（手动下载） |\n| SysWhispers3 | 生成直接 \u002F 间接 syscall stub | ✓（git clone + python） |\n| Hell's Gate POC | 动态 SSN 解析参考实现 | ✓（git clone） |\n| windbg + IDA | 静态逆 EDR DLL \u002F 内核 callback | ✗（自己装） |\n| Sysmon + olaf config | 本地验证环境 | ✓ |\n\n### 自举命令\n\n```powershell\npowershell -NoProfile -ExecutionPolicy Bypass -File \"<SKILL_ROOT>\\skills\\scripts\\bootstrap-reverse.ps1\" -Capability @('pe-sieve','syswhispers3','sysmon') -StartServices\n```\n\n## 路由上下文\n\n**上游入口**：\n\n- `reverse-engineering\u002F` — 需要先理解 EDR DLL \u002F 驱动的实现\n- `attack-chain\u002F` — 决定在 kill chain 的哪个阶段引入本 skill\n\n**同级关联**：\n\n- `pentest-tools\u002Fnetwork-attack-defense.md` — 内网横向时如何与本 skill 联动\n- `malware-analysis\u002F` — 反向视角，看检测方怎么写规则\n- `field-journal\u002F` — 每次实战后回写经验\n\n**下游交付**：\n\n- 生成报告时引用 MITRE ATT&CK **T1562 (Impair Defenses)**、T1562.001 (Disable or Modify Tools)、T1562.006 (Indicator Blocking)、T1055 (Process Injection)、T1027 (Obfuscated Files or Information)\n\n## 法律边界声明\n\n- 仅限合法授权的红队 \u002F 对抗演练 \u002F 自有产品测试\n- 操作前必须取得书面授权（SoW \u002F 测试合同 \u002F SRC 范围说明）\n- 不得用于未授权目标，不得超出授权范围\n- 发现高危问题立即向客户报告，遵循负责任披露\n- 所有报告中真实目标信息必须脱敏（IP \u002F 主机名 \u002F 域名 \u002F 凭证占位）\n\n## 参考资料\n\n- 详细 hook 调研：`references\u002Fhook-survey.md`\n- unhook \u002F syscall 技术：`references\u002Funhook-techniques.md`\n- ETW \u002F AMSI \u002F 反取证：`references\u002Ftelemetry-blinding.md`\n- MITRE ATT&CK T1562：\u003Chttps:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1562\u002F>\n\n\n## 任务完成自检（声称完成前 MUST 通过）\n\n- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？\n- [ ] 我是否基于 `tool-index` 使用了真实工具路径？\n- [ ] 我是否产出了可复现证据（命令\u002F脚本\u002F截图\u002F报告）？\n- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？\n\n## Limitations\n\n- Lab environment only: deploying bypasses against monitored production systems is out of scope and illegal without authorization.\n- Technique descriptions age quickly as EDR vendors adapt.\n\n> Adapted from [zhaoxuya520\u002Freverse-skill](https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill) (MIT).\n",{"name":5,"risk":43,"source":44,"license":14,"date_added":45,"description":7,"source_repo":46,"source_type":31,"license_source":47},"offensive","https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill","2026-08-25","zhaoxuya520\u002Freverse-skill","https:\u002F\u002Fgithub.com\u002Fzhaoxuya520\u002Freverse-skill\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fedr-bypass-re","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill edr-bypass-re",{"tool":59,"command":60},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill edr-bypass-re",{"tool":62,"command":63},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill edr-bypass-re","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fedr-bypass-re\u002FSKILL.md",true,[67,73,77],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fhook-survey.md","REFERENCE","参考文档",9594,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fedr-bypass-re\u002Freferences\u002Fhook-survey.md",{"path":74,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":75,"sourceHtmlUrl":76},"references\u002Ftelemetry-blinding.md",12695,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fedr-bypass-re\u002Freferences\u002Ftelemetry-blinding.md",{"path":78,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Funhook-techniques.md",11100,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fedr-bypass-re\u002Freferences\u002Funhook-techniques.md",[82,110,134,158,186,209],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":93,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[88],{"categoryNo":89,"categoryName":90,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[94,95,96,97,98,99,84,100,101,102,103,33,31,30,104,105,106,107,108,109],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","access","configure","active","critical","scope","scripts","relevant","implementing",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[117,118,119,120,121,122,123,124,125,126,127,128,129,33,130,31,131,132,105,133],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[141,142,143,144,145,146,147,29,148,149,150,151,152,31,30,153,154,155,156,157],"transcript","youtube transcript","youtube","safe","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":175,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[164,167,170],{"categoryNo":165,"categoryName":166,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":168,"categoryName":169,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":171,"categoryName":172,"taxonomyType":173,"taxonomyTypeDesc":174},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[141,142,143,176,144,177,145,146,29,178,179,180,181,150,182,31,30,183,184,185],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":196,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[192,195],{"categoryNo":193,"categoryName":194,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":168,"categoryName":169,"taxonomyType":91,"taxonomyTypeDesc":92},[143,197,198,121,144,199,200,201,202,29,180,203,204,205,206,30,28,153,207,208],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","dair-academy","viewer",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[215],{"categoryNo":165,"categoryName":166,"taxonomyType":91,"taxonomyTypeDesc":92},[217,143,218,219,144,177,178,220,221,179,180,181,150,222,182,31,30,183,223,156],"youtube full","full","google","server","dlp","credits","automatic"]