Payload Download Cradles
This are different types of download cradles which should be an inspiration to play and create new download cradles to bypass AV/EPP/EDR in context of download cradle detections. Notice, removing or obfuscating signatures from your download cradle is only one piece of the puzzle to bypass an AV/EPP/EDR. Depending on the respective product you have to modify your payload which should be downloaded by the cradle to bypass API-Hooking, Callbacks, AMSI etc.
For PowerShell obfuscation I used as usual the amazing tool Invoke Obufscation from Daniel Bohannon https://github.com/danielbohannon/Invoke-Obfuscation