Der BenjiandClaude Opus 4.6
c37272daa6
Jekyll collections require the underscore-prefixed directory naming convention (_challenges, _solutions). Move files accordingly, extract index pages to root with proper permalinks, and fix defaults scope in _config.yml to use type-based matching. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
5.1 KiB
layout, title, permalink
| layout | title | permalink |
|---|---|---|
| default | Challenges | /challenges/ |
EDR Bypass Challenges
20 challenges across 5 categories. Start with Easy and work your way up.
Category 1: Process Name Evasion
01 - Binary Rename
Rename a blacklisted tool to bypass process name detection
Easy02 - Case Sensitivity Exploit
Exploit case-sensitive string comparison in the blacklist
Easy03 - Copy and Rename
Copy a tool to a new filename to avoid detection
Easy04 - Unlisted Tool
Use a tool that isn't in the hardcoded blacklist
Category 2: Command Line Obfuscation
05 - Path Manipulation
Use path tricks to confuse the filename check
Easy06 - Caret Insertion
Use cmd.exe escape characters to break keyword matching
Medium07 - Environment Variable Substitution
Use environment variables to hide command keywords
Medium08 - Base64 Encoded Commands
Encode commands to bypass keyword detection
Easy09 - The Useless Rule
Discover why reconnaissance commands are never blocked
Category 3: Process Monitoring Bypass
10 - Timing Attack
Exploit the polling interval to execute undetected
Easy11 - Pre-Existing Process
Be running before the EDR starts monitoring
Medium12 - Living Off The Land
Use built-in tools and alternative commands
Medium13 - LSASS Without Keywords
Dump LSASS without triggering keyword detection
Medium14 - Tool Rename for LSASS
Rename dump tools to bypass the dual-condition rule
Category 4: Execution Evasion
15 - Alternative PowerShell Host
Execute PowerShell without powershell.exe
Medium16 - Elevated Process Evasion
Exploit the EDR's inability to read elevated processes
Medium17 - 32-Bit Process Evasion
Use a 32-bit process to break PEB reading
Hard18 - Unicode Process Names
Exploit ASCII-only string handling with Unicode characters