EncodingKernelcallbacksETWTiPatchingPPIDspoofingStringconcatenationUncommonprogramminglanguageCompressionProcessMitigationPolicyEncryptionDirectSyscallsHooking/UnhookingAMSIPatchingAPC injection/AtombombingRun-timebinarymodificationBreakingprocess-childrelationshipPackingDLLinjectionDynamicAPIresolvingPEinjectionProcessInjectionVM-basedcodeexecutionHookInjectionP/Invoke&D/InvokeCodesigningbypassEncodingKernelcallbacksETWTiPatchingPPIDspoofingStringconcatenationUncommonprogramminglanguageCompressionProcessMitigationPolicyEncryptionDirectSyscallsHooking/UnhookingAMSIPatchingAPC injection/AtombombingRun-timebinarymodificationBreakingprocess-childrelationshipPackingDLLinjectionDynamicAPIresolvingPEinjectionProcessInjectionVM-basedcodeexecutionHookInjectionP/Invoke&D/InvokeCodesigningbypass

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. Encoding
  2. Kernel callbacks
  3. ETWTi Patching
  4. PPID spoofing
  5. String concatenation
  6. Uncommon programming language
  7. Compression
  8. Process Mitigation Policy
  9. Encryption
  10. Direct Syscalls
  11. Hooking/ Unhooking
  12. AMSI Patching
  13. APC injection / Atombombing
  14. Run-time binary modification
  15. Breaking process-child relationship
  16. Packing
  17. DLL injection
  18. Dynamic API resolving
  19. PE injection
  20. Process Injection
  21. VM-based code execution
  22. Hook Injection
  23. P/Invoke & D/Invoke
  24. Code signing bypass