CMEPW/BypassAV, a mind map of AV and EDR evasion techniques

CMEPW/BypassAV is a Markmap mind map of techniques for getting payloads past anti-virus and EDR, from loaders in Go, Nim or Rust to obfuscation and process injection such as APC injection and process hollowing. It recommends the linked manual write-ups over open source tools, which AV vendors know just as well. For the view from the other side, Monnappa K A’s Black Hat Asia 2017 whitepaper shows how memory forensics still catches a hollowed process by comparing its PEB with the kernel’s VAD entries, and automates that check in the Volatility plugin HollowFind.