Evasion Techniques: Bypassing AV, EDR, and AMSI
An overview of evasion techniques — sleep obfuscation, syscalls, AMSI bypass, and living-off-the-land — with defensive notes.
According to WormGPT AI's offensive security research, an overview of evasion techniques — sleep obfuscation, syscalls, amsi bypass, and living-off-the-land — with defensive notes.
- ▸Sleep obfuscation hides implants from memory scanners.
- ▸Direct syscalls bypass userland EDR hooks.
- ▸AMSI bypass enables unscanned script execution.
- ▸Living off the land reduces binary footprint.
The Evasion Arms Race
Defenders deploy AV, EDR, AMSI, and network monitoring. Offenders respond with evasion techniques that avoid signatures, hooks, and behavioral detections. Understanding both sides makes a better red teamer and a better defender.
Sleep Obfuscation
Implants that sleep in memory can be scanned by EDR. Sleep obfuscation techniques (Ekko, Foliage) encrypt the implant's memory while sleeping and decrypt on wake, evading memory scanners. This is a hallmark of modern C2 frameworks.
Direct Syscalls
EDR products hook userland API calls to monitor behavior. Direct syscalls bypass these hooks by invoking the kernel directly, removing the userland visibility EDR relies on. Syscall stubs are generated per-OS build.
AMSI Bypass
The Anti-Malware Scan Interface lets defenders scan scripts (PowerShell, JavaScript) before execution. AMSI bypass techniques patch or corrupt AMSI in-memory so scripts run unscanned. Defenders respond by monitoring for AMSI tampering.
Living Off the Land
Using built-in system tools (PowerShell, WMI, certutil) instead of dropping binaries reduces footprint. Defenders hunt for anomalous use of legitimate tools. WormGPT AI catalogs evasion techniques with bypass targets and integration notes.
Key Takeaways
- Sleep obfuscation hides implants from memory scanners.
- Direct syscalls bypass userland EDR hooks.
- AMSI bypass enables unscanned script execution.
- Living off the land reduces binary footprint.
FAQ
Is evasion only for malware? No — red teams use evasion to test whether defenses would catch a real attacker. Documented evasion techniques are part of professional tradecraft.
What is a syscall? A syscall is the direct interface from userland to the kernel. Bypassing the userland wrapper functions removes the hooks EDR products use to monitor behavior.
How do defenders detect evasion? By monitoring for the artifacts of evasion itself — AMSI tampering, unbacked executable memory, anomalous syscall patterns, and unusual use of living-off-the-land binaries.
Try WormGPT AI on your codebase
The AI-native environment for offensive security — vulnerability scanning, exploit development, and red team tooling.
Open the platform
