evasion - Chern0bit

Tag: evasion

Aug 27, 2026 Windows Post-Exploitation 1 min read

A filter-to-consumer binding stored in the WMI repository runs your payload on an event trigger with no file on disk and no Run key.

evasion persistence wmi

Aug 16, 2026 Red Team & Evasion 1 min read

Reparenting a spawned process under explorer.exe and setting the block-non-Microsoft-DLL policy breaks EDR user-mode hooks and heuristics at once.

evasion ppid-spoofing process-creation

Aug 16, 2026 Red Team & Evasion 1 min read

Neutering EtwEventWrite in your process stops the CLR and many sensors from reporting your activity to userland providers.

etw evasion telemetry

Aug 16, 2026 Red Team & Evasion 1 min read

A single-byte patch to AmsiScanBuffer in the current process disables the scan for every script and assembly you load afterwards.

amsi evasion in-memory

Aug 15, 2026 Red Team & Evasion 1 min read

Trusted Windows binaries fetch and run code, avoiding a fresh unsigned executable on disk.

evasion execution lolbin

Jun 10, 2026 AI & LLM Security 1 min read

When an LLM scores or moderates content, an appended suffix can flip its verdict without changing the visible meaning.

evasion llm-as-judge