Bypassing Endpoint Security

• Fast flux DNS method

• CPL (Control Panel) Side-Loading

• Process Injection

• Reducing entropy

• Direct system call Bypass

• In-memory encryption of beacon

• Bypassing EDR

• Bypassing Antivirus

• Bypassing Antimalware Scan Interface

The ability of adversaries to bypass modern Endpoint Detection and Response (EDR) solutions and other endpoint security measures relies on highly technical evasion techniques. These methods are designed to conceal malicious activity, enabling persistence and lateral movement without triggering security alerts.

The sources provide a detailed classification of these techniques, often aiming to exploit the trust placed in legitimate system processes or to manipulate memory and execution flows.

Here are the specific Endpoint Security Evasion Techniques detailed in the source material:

I. Techniques Leveraging Trusted Processes and Binary Manipulation

These methods abuse legitimate operating system components to proxy malicious execution or hide code activity:

• Signed Binary Proxy Execution
  • This technique allows attackers to leverage trusted in-built utilities (such as rundll.32) for the execution of malicious codes.
  • Attackers use these legitimate utilities because they are signed with Digital Certificates, which helps in proxying the malicious code execution to evade EDR solutions.
• Living off the Land Binaries (LolBins)
  • Attackers exploit legitimate system tools that are preinstalled on the OS (often downloaded from trusted sources like Microsoft).
  • By leveraging LoLBins, an attacker’s actions appear to be normal and authorized, helping them evade EDR systems, even when performing activities like installing Command and Control (C2) agents.
• Ghostwriting
  • This technique modifies the structure of the malware code without affecting its core functionality.
  • It is used to bypass antivirus software and hide malware to evade signature-based detection by employing binary deconstruction and the insertion of arbitrary assembly code.
• Application Whitelisting Bypass
  • Attackers exploit whitelisting by using trusted Windows binaries such as rundll32.exe, regsvr32.exe, and Powershell to load malicious Dynamic Link Libraries (DLLs) and bypass endpoint security solutions.
• CPL (Control Panel) Side-Loading
  • This method leverages legitimate Control Panel applet files (.cpl).
  • It mimics the original CPL applet functionality to make malicious activity appear legitimate to users and security systems, thereby concealing the malicious code embedded within it.
• Dechaining Macros
  • Used to evade endpoint detection by exploiting Microsoft Office macros and creating VBA-based malicious codes.
  • Techniques include Spawning using XMLDOM (using XMLDOM objects within an Office process to download and run code) and Registry Modification (using VBScript to access the registry for persistence).

II. Memory and Kernel-Level Evasion Techniques

These advanced techniques manipulate the core operating system functions, especially those relied upon by EDR systems:

• Clearing Memory Hooks
  • Endpoint Detection and Response (EDR) agents place memory hooks to collect information for behavior-based analysis.
  • Attackers bypass the EDR by ==unhooking the EDR DLLs in memory, often using debugging tools like x64dbg to identify and overwrite the hooked syscalls, thereby restoring the exact bytes of data and preventing the EDR from receiving information.==
• Process Injection
  • This involves injecting malicious code into the memory space of a running, legitimate process.
  • This technique helps malware evade security software that might overlook monitoring the internal state of every process for changes, and is part of a strategy for maintaining Persistence and escalating privileges.
• Disabling Event Tracing for Windows (ETW)
  • Many EDR solutions, including Microsoft Defender for Endpoints, rely on ETW for extensive tracking of processes and Windows API calls.
  • Attackers can gain control over ntdll.dll and patch the EtwEventWrite function to return success (zero), effectively stopping the EDR system from monitoring subsequent system activities.
• In-memory Encryption of Beacon
  • To evade memory scanning while the malware (beacon) is dormant, attackers encrypt the executable memory regions (using methods like XOR) and invoke the Sleep() function.
  • When the system wakes up, the memory segment containing the shellcode is decrypted and execution is restored, effectively bypassing security solutions during the dormant period.
• Direct System Calls
  • This technique leverages direct system calls to evade hooks implemented in ntdll.dll by security solutions.
  • Attackers retrieve the system call ID, push arguments onto the stack, and call the syscall instruction directly.

III. Payload and Signature Obfuscation Techniques

These techniques focus on hiding the payload or altering its characteristics to confuse detection mechanisms:

• Shellcode Encryption
  • Attackers encrypt commands containing malicious payloads using algorithms such as XOR, RC4, or AES to evade EDR solutions.
  • The decryption keys are either embedded within the malware or generated dynamically, allowing the shellcode to be decrypted and executed only in memory.
• Reducing Entropy
  • Attackers manipulate the binary's characteristics to make them appear less suspicious.
  • This involves incorporating low-entropy resources (like low-entropy images) or system strings (like chrome.dll) into the binary to confuse security solutions.
• Passing Encoded Commands
  • Commands are encoded (e.g., using Base64 or hex-format encryption) to cover arguments and code, thus bypassing detection mechanisms.
• Polymorphic Shellcode
  • Attackers encode the payload and place a decoder before it, ensuring the shellcode is completely rewritten each time it is sent to circumvent signature-based IDS/NIDS which identify commonly used strings.
• Using Metasploit Templates
  • Attackers continuously modify Metasploit templates to decrease the detection rate shown by tools like VirusTotal, thereby evading antivirus software.
• Using ChatGPT
  • Attackers utilize AI tools like ChatGPT to mutate malicious code and create multiple versions of that code, making it challenging for endpoint security systems to detect.

IV. Sandbox and Timing Evasion Techniques

These techniques exploit the nature and limitations of sandbox environments:

• Timing-based Evasion
  • A sandbox evasion technique where malware execution is delayed until a specific time or after certain actions are performed by the victim (e.g., using sleep patching, delay APIs, or time bombs).
  • This method exploits the short execution window typically allotted to local sandboxes.
• Escaping the (Local) AV Sandbox
  • Attackers exploit the time limitation of EDR local sandbox evaluations (typically a few seconds) by delaying shellcode execution (e.g., by calculating large prime numbers to extend the encryption process time).

Summary of Evasion Tactics

These complex techniques highlight that modern adversaries are highly adaptive, leveraging system trust and low-level code manipulation. They treat endpoint security agents not as absolute barriers, but as systems to be fingerprinted, understood, and subsequently bypassed. This contrasts sharply with older attacks that focused solely on exploiting vulnerabilities in network hardware like firewalls and IDSs.