> For the complete documentation index, see [llms.txt](https://docs.redteamleaders.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.redteamleaders.com/offensive-security/defense-evasion.md).

# Defense Evasion

- [Simple Shellcode Runner in Rust](https://docs.redteamleaders.com/offensive-security/defense-evasion/simple-shellcode-runner-in-rust.md)
- [Pass the Hash Attack with Mimikatz and PsExec](https://docs.redteamleaders.com/offensive-security/defense-evasion/pass-the-hash-attack-with-mimikatz-and-psexec.md)
- [Direct Syscall Execution in Windows](https://docs.redteamleaders.com/offensive-security/defense-evasion/direct-syscall-execution-in-windows.md)
- [Hookchain Technique Introduction by Helvio Júnior (M4v3r1ck)](https://docs.redteamleaders.com/offensive-security/defense-evasion/hookchain-technique-introduction-by-helvio-junior-m4v3r1ck.md)
- [Probabilistic Call Stack: A Deep Dive into Non-Deterministic Execution Paths](https://docs.redteamleaders.com/offensive-security/defense-evasion/probabilistic-call-stack-a-deep-dive-into-non-deterministic-execution-paths.md)
- [AMSI Bypass - Neutralizing the Microsoft Antimalware Scan Interface](https://docs.redteamleaders.com/offensive-security/defense-evasion/amsi-bypass-neutralizing-the-microsoft-antimalware-scan-interface.md)
- [ETW Bypass - Blinding Windows Telemetry](https://docs.redteamleaders.com/offensive-security/defense-evasion/etw-bypass-blinding-windows-telemetry.md)
- [Indirect Syscalls — Preserving a Legitimate Stack Trace](https://docs.redteamleaders.com/offensive-security/defense-evasion/indirect-syscalls-preserving-a-legitimate-stack-trace.md)
- [API Unhooking — Restoring ntdll to a Clean State](https://docs.redteamleaders.com/offensive-security/defense-evasion/api-unhooking-restoring-ntdll-to-a-clean-state.md)
- [Process Hollowing — Gutting Legitimate Processes](https://docs.redteamleaders.com/offensive-security/defense-evasion/process-hollowing-gutting-legitimate-processes.md)
- [Reflective DLL Injection — DLLs That Load Themselves](https://docs.redteamleaders.com/offensive-security/defense-evasion/reflective-dll-injection-dlls-that-load-themselves.md)
- [PPID Spoofing — Forging the Process Tree](https://docs.redteamleaders.com/offensive-security/defense-evasion/ppid-spoofing-forging-the-process-tree.md)
- [Token Impersonation — Identity Theft on Windows](https://docs.redteamleaders.com/offensive-security/defense-evasion/token-impersonation-identity-theft-on-windows.md)
- [Shellcode Obfuscation — Hiding Payloads from Static Detection](https://docs.redteamleaders.com/offensive-security/defense-evasion/shellcode-obfuscation-hiding-payloads-from-static-detection.md)
- [APC Injection — Execution via Asynchronous Procedure Call Queues](https://docs.redteamleaders.com/offensive-security/defense-evasion/apc-injection-execution-via-asynchronous-procedure-call-queues.md)
- [Heaven's Gate — Calling 64-bit Code from a 32-bit Process](https://docs.redteamleaders.com/offensive-security/defense-evasion/heavens-gate-calling-64-bit-code-from-a-32-bit-process.md)
- [Sleep Obfuscation — Encrypting Beacons During Rest](https://docs.redteamleaders.com/offensive-security/defense-evasion/sleep-obfuscation-encrypting-beacons-during-rest.md)