CodesigningbypassDynamicAPIresolvingCompressionEncodingDLLinjectionAPC injection/AtombombingETWTiPatchingHookInjectionVM-basedcodeexecutionEncryptionPackingUncommonprogramminglanguageStringconcatenationBreakingprocess-childrelationshipKernelcallbacksAMSIPatchingP/Invoke&D/InvokeProcessInjectionRun-timebinarymodificationHooking/UnhookingProcessMitigationPolicyDirectSyscallsPPIDspoofingPEinjectionCodesigningbypassDynamicAPIresolvingCompressionEncodingDLLinjectionAPC injection/AtombombingETWTiPatchingHookInjectionVM-basedcodeexecutionEncryptionPackingUncommonprogramminglanguageStringconcatenationBreakingprocess-childrelationshipKernelcallbacksAMSIPatchingP/Invoke&D/InvokeProcessInjectionRun-timebinarymodificationHooking/UnhookingProcessMitigationPolicyDirectSyscallsPPIDspoofingPEinjection

Bypassing AV/EDR bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
  1. Code signing bypass
  2. Dynamic API resolving
  3. Compression
  4. Encoding
  5. DLL injection
  6. APC injection / Atombombing
  7. ETWTi Patching
  8. Hook Injection
  9. VM-based code execution
  10. Encryption
  11. Packing
  12. Uncommon programming language
  13. String concatenation
  14. Breaking process-child relationship
  15. Kernel callbacks
  16. AMSI Patching
  17. P/Invoke & D/Invoke
  18. Process Injection
  19. Run-time binary modification
  20. Hooking/ Unhooking
  21. Process Mitigation Policy
  22. Direct Syscalls
  23. PPID spoofing
  24. PE injection