windows-mitigations-bypass

Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill windows-mitigations-bypass

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

13 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Windows Mitigations & Bypass

Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement.

When to Activate

Fingerprinting a target's mitigation landscape before weaponizing an exploit

Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain

Bypassing application control (WDAC / App Control for Business) to run unsigned code

Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation

Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR

Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state

Technique Map

Technique

ATT&CK

CWE

Reference

Script

ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module)

T1211

CWE-330

references/memory-safety-mitigations.md

scripts/find_nonaslr_modules.py

DEP/NX bypass (ROP→VirtualProtect, ret2libc)

T1211

CWE-119

references/memory-safety-mitigations.md

scripts/cfg_dispatch_gadget_finder.py

CFG/XFG bypass (valid-target dispatch gadget, type-hash collision)

T1211

CWE-1240

references/memory-safety-mitigations.md

scripts/cfg_dispatch_gadget_finder.py

CET shadow stack / IBT evasion (non-CET process, JOP, exception unwind)

T1211

CWE-1419

references/memory-safety-mitigations.md

scripts/Get-ProcessMitigationMap.ps1

ACG/CIG bypass (signed-code reuse, JIT exemption, cross-process)

T1211, T1055

CWE-94

references/acg-cig-dynamic-code.md

scripts/Get-ProcessMitigationMap.ps1

WDAC / App Control bypass (LOLBin, signed Electron/V8, sideload)

T1218

CWE-693

references/wdac-app-control-bypass.md

scripts/mitigation_recon.ps1

ASR rule bypass (excluded path/process hollow, COM, syscalls)

T1562.001

CWE-693

references/asr-amsi-etw-blinding.md

scripts/extract_asr_exclusions.py

Windows Mitigations & Bypass

When to Activate

Fingerprinting a target's mitigation landscape before weaponizing an exploit

Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain

Bypassing application control (WDAC / App Control for Business) to run unsigned code

Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation

Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR

Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state

Technique Map

Technique

ATT&CK

CWE

Reference

Script

ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module)

T1211

CWE-330

references/memory-safety-mitigations.md

scripts/find_nonaslr_modules.py

DEP/NX bypass (ROP→VirtualProtect, ret2libc)

T1211

CWE-119

references/memory-safety-mitigations.md

scripts/cfg_dispatch_gadget_finder.py

CFG/XFG bypass (valid-target dispatch gadget, type-hash collision)

T1211

CWE-1240

references/memory-safety-mitigations.md

scripts/cfg_dispatch_gadget_finder.py

CET shadow stack / IBT evasion (non-CET process, JOP, exception unwind)

T1211

CWE-1419

references/memory-safety-mitigations.md

scripts/Get-ProcessMitigationMap.ps1

ACG/CIG bypass (signed-code reuse, JIT exemption, cross-process)

T1211, T1055

CWE-94

references/acg-cig-dynamic-code.md

scripts/Get-ProcessMitigationMap.ps1

WDAC / App Control bypass (LOLBin, signed Electron/V8, sideload)

T1218

CWE-693

references/wdac-app-control-bypass.md

scripts/mitigation_recon.ps1

ASR rule bypass (excluded path/process hollow, COM, syscalls)

T1562.001

CWE-693

references/asr-amsi-etw-blinding.md

scripts/extract_asr_exclusions.py

name	windows-mitigations-bypass
description	Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI
metadata	{"type":"offensive","phase":"exploitation","tools":["WinDbg","IDA","x64dbg","Process Hacker","ROPgadget","mona.py","PPLmedic","nanodump","EDRSandblast"],"mitre":["T1211","T1218","T1562.001","T1562.004","T1562.006","T1003.001","T1068","T1620","T1140"]}
kill_chain	{"phase":["exploit","installation"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1211","T1218","T1562.001","T1562.004","T1562.006","T1003.001","T1068","T1620","T1112"]}
depends_on	["exploit-development","reverse-engineering"]
feeds_into	["shellcode-dev","edr-evasion","windows-boundaries"]
inputs	["mitigation_config","binary_analysis","target_os_build"]
outputs	["bypass_technique","finding_record","mitigation_fingerprint"]
references	["references/memory-safety-mitigations.md","references/acg-cig-dynamic-code.md","references/wdac-app-control-bypass.md","references/asr-amsi-etw-blinding.md","references/ppl-lsa-protection.md","references/byovd-vbs-hvci.md"]
scripts	["scripts/mitigation_recon.ps1","scripts/Get-ProcessMitigationMap.ps1","scripts/find_nonaslr_modules.py","scripts/cfg_dispatch_gadget_finder.py","scripts/extract_asr_exclusions.py","scripts/check_driver_blocklist.py"]

name	windows-mitigations-bypass
description	Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI
metadata	{"type":"offensive","phase":"exploitation","tools":["WinDbg","IDA","x64dbg","Process Hacker","ROPgadget","mona.py","PPLmedic","nanodump","EDRSandblast"],"mitre":["T1211","T1218","T1562.001","T1562.004","T1562.006","T1003.001","T1068","T1620","T1140"]}
kill_chain	{"phase":["exploit","installation"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1211","T1218","T1562.001","T1562.004","T1562.006","T1003.001","T1068","T1620","T1112"]}
depends_on	["exploit-development","reverse-engineering"]
feeds_into	["shellcode-dev","edr-evasion","windows-boundaries"]
inputs	["mitigation_config","binary_analysis","target_os_build"]
outputs	["bypass_technique","finding_record","mitigation_fingerprint"]
references	["references/memory-safety-mitigations.md","references/acg-cig-dynamic-code.md","references/wdac-app-control-bypass.md","references/asr-amsi-etw-blinding.md","references/ppl-lsa-protection.md","references/byovd-vbs-hvci.md"]
scripts	["scripts/mitigation_recon.ps1","scripts/Get-ProcessMitigationMap.ps1","scripts/find_nonaslr_modules.py","scripts/cfg_dispatch_gadget_finder.py","scripts/extract_asr_exclusions.py","scripts/check_driver_blocklist.py"]

Technique	Telemetry / IOC	Detection (Sigma / EDR)	OPSEC note
ROP/JOP exploit	crash dumps, WER, #CP/#PF exceptions, RWX alloc	EDR stack-walk on VirtualProtect/VirtualAlloc; CFG/CET #CP telemetry	prefer data-only; reuse signed gadgets; avoid RWX
WDAC LOLBin	4688 w/ MSBuild/mshta parent, child of office/explorer	Sigma proc_creation_win_lolbin_*; CodeIntegrity 3076/3077 audit	use Microsoft-signed Electron/V8 — looks like normal app
AMSI patch	RWX in amsi.dll, AMSI scan gaps	AMSI bypass detections, mem scan of amsi.dll .text	indirect syscalls; restore bytes; HWBP avoids byte edits
ETW patch	EtwEventWrite first byte = 0xC3/0xCC	ETW-TI sensor; integrity scan of ntdll EtwEventWrite	restore after use; or disable provider not whole API
PPL LSASS dump	handle to lsass w/ VM_READ, MiniDump call, 4656/4663	Sysmon 10 GrantedAccess 0x1010/0x1410; Defender ASR 9e6c...	userland PPLmedic avoids driver IOC; rename per ASR excl.
BYOVD	Sysmon 6 driver load, svc create reg, unsigned-by-MS driver	Sysmon EID6 + reg EID13; MDE LOLDrivers hash hunt; blocklist	pick driver NOT in MS blocklist/LOLDrivers; HVCI may still block
VBS/HVCI off	bcdedit hypervisorlaunchtype off, DeviceGuard reg writes	reg EID13 on DeviceGuard; boot config change events	requires admin+reboot — loud; data-only attack instead

windows-mitigations-bypass

Install options

Review the source files