VM-basedcodeexecutionPEinjectionHookInjectionETWTiPatchingDLLinjectionDynamicAPIresolvingStringconcatenationP/Invoke&D/InvokeAPC injection/AtombombingDirectSyscallsCodesigningbypassEncodingPackingHooking/UnhookingEncryptionPPIDspoofingBreakingprocess-childrelationshipAMSIPatchingCompressionProcessInjectionUncommonprogramminglanguageProcessMitigationPolicyKernelcallbacksRun-timebinarymodificationVM-basedcodeexecutionPEinjectionHookInjectionETWTiPatchingDLLinjectionDynamicAPIresolvingStringconcatenationP/Invoke&D/InvokeAPC injection/AtombombingDirectSyscallsCodesigningbypassEncodingPackingHooking/UnhookingEncryptionPPIDspoofingBreakingprocess-childrelationshipAMSIPatchingCompressionProcessInjectionUncommonprogramminglanguageProcessMitigationPolicyKernelcallbacksRun-timebinarymodification

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. VM-based code execution
  2. PE injection
  3. Hook Injection
  4. ETWTi Patching
  5. DLL injection
  6. Dynamic API resolving
  7. String concatenation
  8. P/Invoke & D/Invoke
  9. APC injection / Atombombing
  10. Direct Syscalls
  11. Code signing bypass
  12. Encoding
  13. Packing
  14. Hooking/ Unhooking
  15. Encryption
  16. PPID spoofing
  17. Breaking process-child relationship
  18. AMSI Patching
  19. Compression
  20. Process Injection
  21. Uncommon programming language
  22. Process Mitigation Policy
  23. Kernel callbacks
  24. Run-time binary modification