Windows Mitigations Bypass Skill for Claude

Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI

24k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

334

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill windows-mitigations-bypass

What comes with it

89 426 bytes besides the instruction

references/acg-cig-dynamic-code.md

references/asr-amsi-etw-blinding.md

references/byovd-vbs-hvci.md

references/memory-safety-mitigations.md

references/ppl-lsa-protection.md

references/wdac-app-control-bypass.md

scripts/Get-ProcessMitigationMap.ps1

scripts/cfg_dispatch_gadget_finder.py

scripts/check_driver_blocklist.py

scripts/extract_asr_exclusions.py

scripts/find_nonaslr_modules.py

scripts/mitigation_recon.ps1

The instruction itself

6 sections, as written by the author

Windows Mitigations & Bypass

Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls

(WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection +

OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement.

When to Activate

Fingerprinting a target's mitigation landscape before weaponizing an exploit
Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain
Bypassing application control (WDAC / App Control for Business) to run unsigned code
Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation
Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR
Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state

Technique Map

|-----------|--------|-----|-----------|--------|

Quick Start

# 1. Fingerprint system + per-process mitigations, AMSI/ETW/ASR/WDAC/VBS state
powershell -ep bypass -f scripts/mitigation_recon.ps1 -OutJson recon.json
powershell -ep bypass -f scripts/Get-ProcessMitigationMap.ps1   # rank weak processes

# 2. If memory-corruption target: locate non-ASLR modules + CFG-valid dispatch gadgets
python scripts/find_nonaslr_modules.py C:\Target\*.dll
python scripts/cfg_dispatch_gadget_finder.py target.dll        # ROP/JOP under CFG/CET

# 3. If application control (WDAC) blocks execution: pick a signed bypass vessel
#    MSBuild inline C#, signed legacy Teams (Electron), or signed Node .node module

# 4. Blind telemetry before post-ex (use sparingly — patching is itself an IOC)
#    AMSI: patch AmsiScanBuffer / amsiInitFailed   ETW: patch EtwEventWrite

# 5. Credential access vs PPL/LSA: userland PPLmedic chain (no driver) or BYOVD
python scripts/extract_asr_exclusions.py                         # find ASR-excluded paths
python scripts/check_driver_blocklist.py mydriver.sys           # is driver blocklisted/HVCI-safe?

OPSEC & Detection (summary)

|-----------|-----------------|--------------------------|------------|

| ROP/JOP exploit | crash dumps, WER, #CP/#PF exceptions, RWX alloc | EDR stack-walk on VirtualProtect/VirtualAlloc; CFG/CET #CP telemetry | prefer data-only; reuse signed gadgets; avoid RWX |

| WDAC LOLBin | 4688 w/ MSBuild/mshta parent, child of office/explorer | Sigma proc_creation_win_lolbin_*; CodeIntegrity 3076/3077 audit | use Microsoft-signed Electron/V8 — looks like normal app |

| PPL LSASS dump | handle to lsass w/ VM_READ, MiniDump call, 4656/4663 | Sysmon 10 GrantedAccess 0x1010/0x1410; Defender ASR 9e6c... | userland PPLmedic avoids driver IOC; rename per ASR excl. |

| BYOVD | Sysmon 6 driver load, svc create reg, unsigned-by-MS driver | Sysmon EID6 + reg EID13; MDE LOLDrivers hash hunt; blocklist | pick driver NOT in MS blocklist/LOLDrivers; HVCI may still block |

| VBS/HVCI off | bcdedit hypervisorlaunchtype off, DeviceGuard reg writes | reg EID13 on DeviceGuard; boot config change events | requires admin+reboot — loud; data-only attack instead |

Deep Dives

references/memory-safety-mitigations.md — ASLR/HEASLR, DEP/NX, CFG/XFG, Intel CET shadow stack + IBT, SEHOP: how each works on Win11 24H2 and concrete bypass chains (info leak → dispatch gadget → VirtualProtect).
references/acg-cig-dynamic-code.md — Arbitrary Code Guard, Code Integrity Guard, Dynamic Code policy: signed-code-only reuse, JIT/browser exemptions, cross-process pivots, SEC_IMAGE section abuse.
references/wdac-app-control-bypass.md — WDAC / App Control for Business: recommended-block-rule LOLBins, signed Electron (Loki C2) + signed Node .node/V8 exploitation, DLL sideloading, allow-list reality check.
references/asr-amsi-etw-blinding.md — ASR rule bypasses (global exclusion abuse, process hollowing into trusted images), AMSI bypass variants, ETW blinding (full patch vs selective provider disable).
references/ppl-lsa-protection.md — PPL levels & LSA Protection (RunAsPPL), userland PPLmedic exploit chain, PPLBlade/nanodump dumping, Credential Guard reality, BYOVD PPL kill.
references/byovd-vbs-hvci.md — BYOVD kernel R/W primitive build, Microsoft driver blocklist + LOLDrivers + HVCI/Secure Boot evasion (Silver Fox amsdk.sys case), VBS/Credential Guard limits, kernel shadow stack.

Other skills for the same job

different authors, same section of the catalogue

Backend Security Coder

by ComeOnOliver

×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens

Cloud Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens

Codebase Cleanup Deps Audit

by ComeOnOliver

×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens

Linux Privilege Escalation

by ComeOnOliver

×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens

Mobile Security Coder

by ComeOnOliver

×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take hypnguyen1209/windows-mitigations-bypass from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.