# 免杀与规避
English: Evasion & Anti-Detection
- Entry Count: 14
- Use this file to shortlist relevant payloads, then open the linked source markdown for the full workflow and commands.
## PowerShell免杀
- ID: evasion-powershell
- Difficulty: intermediate
- Subcategory: PowerShell
- Tags: powershell, evasion, obfuscation
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-powershell.md
Description:
PowerShell脚本免杀技术
Prerequisites:
- 目标机器访问权限
- Windows系统
Execution Outline:
1. 编码执行
2. 远程加载
3. 混淆变量名
4. 无文件执行
Analysis:
PowerShell免杀可以绕过杀毒软件检测执行恶意脚本。
OPSEC:
- PowerShell日志可能记录命令
- 考虑禁用日志
- 使用混淆技术
## AMSI绕过
- ID: amsi-bypass
- Difficulty: advanced
- Subcategory: AMSI绕过
- Tags: amsi, bypass, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/amsi-bypass.md
Description:
绕过反恶意软件扫描接口
Prerequisites:
- PowerShell环境
- AMSI启用
Execution Outline:
1. 反射绕过
2. 内存修补
3. DLL劫持
4. 使用工具
## ETW Patch绕过
- ID: etw-patch
- Difficulty: advanced
- Subcategory: ETW
- Tags: etw, bypass, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/etw-patch.md
Description:
禁用ETW监控
Prerequisites:
- 代码执行权限
Execution Outline:
1. PowerShell禁用ETW
2. C#禁用ETW
3. 修补ntdll
## API Unhooking
- ID: api-unhooking
- Difficulty: expert
- Subcategory: Unhooking
- Tags: unhooking, hook, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/api-unhooking.md
Description:
移除EDR的API Hook
Prerequisites:
- 代码执行权限
Execution Outline:
1. 从磁盘还原
2. 从KnownDlls还原
3. Hell's Gate
## 进程注入
- ID: process-injection
- Difficulty: advanced
- Subcategory: 进程注入
- Tags: injection, process, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/process-injection.md
Description:
将代码注入到其他进程
Prerequisites:
- 代码执行权限
Execution Outline:
1. 经典DLL注入
2. Process Hollowing
3. APC注入
## AppLocker绕过
- ID: applocker-bypass
- Difficulty: intermediate
- Subcategory: AppLocker
- Tags: applocker, bypass, evasion
- Original Extracted Source: original extracted intranet-security-wiki source/applocker-bypass.md
Description:
绕过AppLocker应用程序限制
Prerequisites:
- AppLocker限制环境
Execution Outline:
1. 使用白名单路径
2. LOLBAS利用
3. InstallUtil
4. MSBuild
## BlockDLLs技术
- ID: evasion-blockdlls
- Difficulty: advanced
- Subcategory: BlockDLLs
- Tags: evasion, blockdlls, edr
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-blockdlls.md
Description:
阻止非微软DLL加载
Prerequisites:
- Windows系统
- Cobalt Strike或其他工具
Execution Outline:
1. Cobalt Strike BlockDLLs
2. 进程创建时启用
3. C#实现
## Shellcode加密
- ID: evasion-shellcode-encrypt
- Difficulty: intermediate
- Subcategory: Shellcode加密
- Tags: evasion, shellcode, encrypt
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-shellcode-encrypt.md
Description:
加密Shellcode绕过静态检测
Prerequisites:
- Shellcode
- 加密工具
Execution Outline:
1. AES加密Shellcode
2. XOR加密
3. RC4加密
4. 多态加密
## 进程伪装
- ID: evasion-process-masq
- Difficulty: intermediate
- Subcategory: 进程伪装
- Tags: evasion, process, masquerade
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-process-masq.md
Description:
伪装进程名称和路径
Prerequisites:
- Windows系统
Execution Outline:
1. PPID欺骗
2. 进程参数欺骗
3. 进程镂空
## PPID欺骗
- ID: evasion-ppid-spoof
- Difficulty: intermediate
- Subcategory: PPID欺骗
- Tags: evasion, ppid, spoofing
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-ppid-spoof.md
Description:
伪造父进程ID
Prerequisites:
- Windows系统
- 父进程句柄
Execution Outline:
1. PowerShell实现
2. C#实现
3. Cobalt Strike
## DLL侧加载
- ID: evasion-dll-sideloading
- Difficulty: intermediate
- Subcategory: DLL侧加载
- Tags: evasion, dll, sideloading
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-dll-sideloading.md
Description:
利用DLL搜索顺序加载恶意DLL
Prerequisites:
- Windows系统
- 可执行文件
Execution Outline:
1. DLL劫持
2. DLL转发
3. 常见目标
## 参数欺骗
- ID: evasion-arg-spoofing
- Difficulty: advanced
- Subcategory: 参数欺骗
- Tags: evasion, argument, spoofing
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-arg-spoofing.md
Description:
欺骗进程参数显示
Prerequisites:
- Windows系统
Execution Outline:
1. 命令行欺骗
2. 环境变量欺骗
3. PEB修改
## 签名二进制利用
- ID: evasion-signed-binary
- Difficulty: intermediate
- Subcategory: 签名二进制
- Tags: evasion, signed, lolbin
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-signed-binary.md
Description:
利用微软签名二进制执行代码
Prerequisites:
- Windows系统
Execution Outline:
1. MSBuild
2. InstallUtil
3. Regsvcs/Regasm
4. Rundll32
## CLR注入
- ID: evasion-clr-injection
- Difficulty: advanced
- Subcategory: CLR注入
- Tags: evasion, clr, injection
- Original Extracted Source: original extracted intranet-security-wiki source/evasion-clr-injection.md
Description:
CLR内存注入技术
Prerequisites:
- Windows系统
- .NET环境
Execution Outline:
1. CLR内存加载
2. C#实现
3. Cobalt Strike

