Run-timebinarymodificationP/Invoke&D/InvokeDLLinjectionPPIDspoofingBreakingprocess-childrelationshipDirectSyscallsEncodingProcessMitigationPolicyHookInjectionEncryptionCompressionPEinjectionAPC injection/AtombombingCodesigningbypassKernelcallbacksHooking/UnhookingPackingProcessInjectionDynamicAPIresolvingVM-basedcodeexecutionETWTiPatchingAMSIPatchingUncommonprogramminglanguageStringconcatenationRun-timebinarymodificationP/Invoke&D/InvokeDLLinjectionPPIDspoofingBreakingprocess-childrelationshipDirectSyscallsEncodingProcessMitigationPolicyHookInjectionEncryptionCompressionPEinjectionAPC injection/AtombombingCodesigningbypassKernelcallbacksHooking/UnhookingPackingProcessInjectionDynamicAPIresolvingVM-basedcodeexecutionETWTiPatchingAMSIPatchingUncommonprogramminglanguageStringconcatenation

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. Run-time binary modification
  2. P/Invoke & D/Invoke
  3. DLL injection
  4. PPID spoofing
  5. Breaking process-child relationship
  6. Direct Syscalls
  7. Encoding
  8. Process Mitigation Policy
  9. Hook Injection
  10. Encryption
  11. Compression
  12. PE injection
  13. APC injection / Atombombing
  14. Code signing bypass
  15. Kernel callbacks
  16. Hooking/ Unhooking
  17. Packing
  18. Process Injection
  19. Dynamic API resolving
  20. VM-based code execution
  21. ETWTi Patching
  22. AMSI Patching
  23. Uncommon programming language
  24. String concatenation