APC injection/AtombombingCompressionVM-basedcodeexecutionETWTiPatchingStringconcatenationBreakingprocess-childrelationshipUncommonprogramminglanguageRun-timebinarymodificationEncryptionHooking/UnhookingKernelcallbacksAMSIPatchingDLLinjectionCodesigningbypassHookInjectionPPIDspoofingPEinjectionPackingEncodingP/Invoke&D/InvokeDirectSyscallsDynamicAPIresolvingProcessMitigationPolicyProcessInjectionAPC injection/AtombombingCompressionVM-basedcodeexecutionETWTiPatchingStringconcatenationBreakingprocess-childrelationshipUncommonprogramminglanguageRun-timebinarymodificationEncryptionHooking/UnhookingKernelcallbacksAMSIPatchingDLLinjectionCodesigningbypassHookInjectionPPIDspoofingPEinjectionPackingEncodingP/Invoke&D/InvokeDirectSyscallsDynamicAPIresolvingProcessMitigationPolicyProcessInjection

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. APC injection / Atombombing
  2. Compression
  3. VM-based code execution
  4. ETWTi Patching
  5. String concatenation
  6. Breaking process-child relationship
  7. Uncommon programming language
  8. Run-time binary modification
  9. Encryption
  10. Hooking/ Unhooking
  11. Kernel callbacks
  12. AMSI Patching
  13. DLL injection
  14. Code signing bypass
  15. Hook Injection
  16. PPID spoofing
  17. PE injection
  18. Packing
  19. Encoding
  20. P/Invoke & D/Invoke
  21. Direct Syscalls
  22. Dynamic API resolving
  23. Process Mitigation Policy
  24. Process Injection