> For the complete documentation index, see [llms.txt](https://www.scriptchildie.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.scriptchildie.com/evasion.md).

# Evasion

- [AV Bypass](https://www.scriptchildie.com/evasion/av-bypass.md)
- [1. Introduction](https://www.scriptchildie.com/evasion/av-bypass/1.-introduction.md): #AVEvasion #Golang #maldev #malwaredevelopment
- [2. Remove the shellcode from the payload](https://www.scriptchildie.com/evasion/av-bypass/2.-remove-the-shellcode-from-the-payload.md): #AVEvasion #Golang #maldev #malwaredevelopment
- [3. Delay Execution](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution.md)
- [1. time.Sleep() 1/2](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution/1.-time.sleep-1-2.md): #AVEvasion #Golang #maldev #malwaredevelopment #sleep
- [2. time.Sleep() 2/2](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution/2.-time.sleep-2-2.md): #AVEvasion #Golang #maldev #malwaredevelopment #sleep
- [3. Custom Sleep function](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution/3.-custom-sleep-function.md): #AVEvasion #Golang #maldev #malwaredevelopment #sleep
- [4. XOR Encryption](https://www.scriptchildie.com/evasion/av-bypass/4.-xor-encryption.md): #AVEvasion #Golang #maldev #malwaredevelopment
- [5. AMSI Bypass](https://www.scriptchildie.com/evasion/av-bypass/5.-amsi-bypass.md): #amsi #amsibypass #golang #maldev #malwaredevelopment
- [EDR Bypass](https://www.scriptchildie.com/evasion/edr-bypass.md): #EDREvasion #Golang #maldev #malwaredevelopment
- [1. Setting up a testing environment](https://www.scriptchildie.com/evasion/edr-bypass/1.-setting-up-a-testing-environment.md): #OpenEDR #xcitium #elastic
- [2. Userland Hooks](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks.md)
- [1. What are userland hooks?](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/1.-what-are-userland-hooks.md): #EDREvasion #UserlandHooks
- [2. Load a fresh copy of the dll from disk](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/2.-load-a-fresh-copy-of-the-dll-from-disk.md): #EDREvasion #UserlandHooks #unhook
- [3. Programmatically detect ntdll hooks](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/3.-programmatically-detect-ntdll-hooks.md): #EDREvasion #UserlandHooks #unhook
- [4. Direct and Indirect Syscalls (shellcode runner)](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/4.-direct-and-indirect-syscalls-shellcode-runner.md): #syscalls #directsyscalls #indirectsyscalls #Golang #EDREvasion
- [3. VPN abuse for Endpoint Protection Evasion](https://www.scriptchildie.com/evasion/edr-bypass/3.-vpn-abuse-for-endpoint-protection-evasion.md)
- [1. Global Protect Abuse 1/2](https://www.scriptchildie.com/evasion/edr-bypass/3.-vpn-abuse-for-endpoint-protection-evasion/1.-global-protect-abuse-1-2.md): #globalprotect #redteaming #globalprotect #VPNabuse
- [2. Global Protect Abuse 2/2](https://www.scriptchildie.com/evasion/edr-bypass/3.-vpn-abuse-for-endpoint-protection-evasion/2.-global-protect-abuse-2-2.md): #globalprotect #redteaming #globalprotect #VPNabuse