DLLinjectionCompressionHookInjectionKernelcallbacksETWTiPatchingUncommonprogramminglanguagePEinjectionVM-basedcodeexecutionHooking/UnhookingDynamicAPIresolvingProcessInjectionProcessMitigationPolicyCodesigningbypassAMSIPatchingRun-timebinarymodificationAPC injection/AtombombingDirectSyscallsEncodingPPIDspoofingPackingStringconcatenationEncryptionBreakingprocess-childrelationshipP/Invoke&D/InvokeDLLinjectionCompressionHookInjectionKernelcallbacksETWTiPatchingUncommonprogramminglanguagePEinjectionVM-basedcodeexecutionHooking/UnhookingDynamicAPIresolvingProcessInjectionProcessMitigationPolicyCodesigningbypassAMSIPatchingRun-timebinarymodificationAPC injection/AtombombingDirectSyscallsEncodingPPIDspoofingPackingStringconcatenationEncryptionBreakingprocess-childrelationshipP/Invoke&D/Invoke

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. DLL injection
  2. Compression
  3. Hook Injection
  4. Kernel callbacks
  5. ETWTi Patching
  6. Uncommon programming language
  7. PE injection
  8. VM-based code execution
  9. Hooking/ Unhooking
  10. Dynamic API resolving
  11. Process Injection
  12. Process Mitigation Policy
  13. Code signing bypass
  14. AMSI Patching
  15. Run-time binary modification
  16. APC injection / Atombombing
  17. Direct Syscalls
  18. Encoding
  19. PPID spoofing
  20. Packing
  21. String concatenation
  22. Encryption
  23. Breaking process-child relationship
  24. P/Invoke & D/Invoke