https://chaelsoo.me/tags/ingehack/Recent content in Ingehack on kanyo's blogHugo -- gohugo.ioen-gbTue, 21 Apr 2026 00:00:00 +0000https://chaelsoo.me/writeups/ingehack-edr-evasion/Tue, 21 Apr 2026 00:00:00 +0000https://chaelsoo.me/writeups/ingehack-edr-evasion/<p>An Active Directory series from IngeHack. The chain is built around a Windows environment with Defender active — meaning before you can do anything meaningful, you have to get your tooling past it. That was the first challenge, and the one this writeup covers for now.</p> <p>The approach was modifying GodPotato to strip or replace the signatures that Defender flags, combined with techniques for building custom versions of common tools that don&rsquo;t carry recognizable bytecode patterns. The two resources below were the most useful references for this:</p>