DynamicAPIresolvingCodesigningbypassP/Invoke&D/InvokeVM-basedcodeexecutionAPC injection/AtombombingKernelcallbacksRun-timebinarymodificationStringconcatenationETWTiPatchingAMSIPatchingPEinjectionEncryptionUncommonprogramminglanguageDirectSyscallsHooking/UnhookingDLLinjectionProcessInjectionPPIDspoofingEncodingPackingHookInjectionProcessMitigationPolicyCompressionBreakingprocess-childrelationshipDynamicAPIresolvingCodesigningbypassP/Invoke&D/InvokeVM-basedcodeexecutionAPC injection/AtombombingKernelcallbacksRun-timebinarymodificationStringconcatenationETWTiPatchingAMSIPatchingPEinjectionEncryptionUncommonprogramminglanguageDirectSyscallsHooking/UnhookingDLLinjectionProcessInjectionPPIDspoofingEncodingPackingHookInjectionProcessMitigationPolicyCompressionBreakingprocess-childrelationship

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. Dynamic API resolving
  2. Code signing bypass
  3. P/Invoke & D/Invoke
  4. VM-based code execution
  5. APC injection / Atombombing
  6. Kernel callbacks
  7. Run-time binary modification
  8. String concatenation
  9. ETWTi Patching
  10. AMSI Patching
  11. PE injection
  12. Encryption
  13. Uncommon programming language
  14. Direct Syscalls
  15. Hooking/ Unhooking
  16. DLL injection
  17. Process Injection
  18. PPID spoofing
  19. Encoding
  20. Packing
  21. Hook Injection
  22. Process Mitigation Policy
  23. Compression
  24. Breaking process-child relationship