Protecting your networks from cyber attacks can feel at times like a game of cat and mouse. Network Defenders deploy new tools or signatures to then have attackers find new ways to avert them. It's a cycle that has been evident since the start of antivirus (AV) solutions. With the movement of the industry away from defenses solely provided by signature-based AV solutions, replacing them with more robust detection capabilities in the form of Endpoint Detection and Response (EDR) solutions, the game continues.
Our Red Teamers work hard to emulate adversaries’ techniques to provide realistic attacks in order to allow Network Defenders to react and respond in their environments. Our Red Teamers utilize many different techniques to bypass EDR solutions in this cat and mouse game. In support of Cybersecurity Awareness month, we are releasing a new technical post on Maveris Labs detailing a few favorite EDR evasion/bypass techniques from one of our Red Teamers. https://lnkd.in/easD4b_R
"Evading the Watchful Eye: A Red Teamer’s Guide to EDR Bypass Techniques" by Alexandre Kim dives deep into common EDR bypass techniques used by attackers. From encrypting payloads to advanced syscall methods and callstack spoofing, this piece uncovers different approaches attackers have taken to circumvent EDRs.
Key takeaways include:
• Understanding how EDRs utilize Userland Hooking, Memory Scanning, Static, and Heuristic Detection.
• Creative encryption and obfuscation methods to bypass static detections.
• Techniques like Perun's Fart, direct/indirect syscalls, and Halo's Gate for evading userland hooks.
• Advanced process injection strategies and the use of non-emulated APIs.
• The art of callstack spoofing and ROP gadgets to make malicious execution appear legitimate.
If you are a Network Defender or a Red Teamer interested in EDR bypass techniques, this is a must-read. This technical article will help the reader better understand multiple EDR evasion techniques.
https://lnkd.in/easD4b_R
#Cybersecurity
#EDREvasion
#RedTeam
#EndpointSecurity
#InfoSec
#ThreatDefense