- Is it possible for an attacker
to bypass the Endpoint Detection Response
or the EDRs and how we can detect that?
So, the answer is yes.
Attackers can actually bypass Endpoint Detection Response
and get their malware
to not have any logs or any significant logs
that you can see and you can actually react
to through yourself or through your
Endpoint Detection Response dashboard.
And the reason for that is there's multiple reasons.
The first thing in the first,
the first issue that most of EDRs facing is
that they do all of their control, all of their monitoring
on all the applications running inside the user mode.
And these are mode is where all the applications are running
inside the actual memory of your application.
And here's the thing, the malware has a full control
over his own memory, he can see what's happening there,
he can unhook the malware, he can unhook the EDR,
he can actually cancel and remove this monitoring,
and there's so many different techniques
for the model to actually get through the EDR,
to cancel all the EDR and monitoring
and get his activities on it.
And this is one type
of bypasses and they are meaning in different ways,
many different techniques to do exactly that
to remove the monitoring from the malware,
to remove all the hooking
and monitoring for all the different files,
opens or process injections or whatever the activities are,
the model can actually remove all the monitoring
on all of these Windows functions
or Windows commands and directly executing these commands
without actually going to the EDR.
So the EDR doesn't see anything
and there's no logs for you to see and
to actually take an action with.
This is one way, and the other way is that
the EDRs can't really go that deep inside
and look everything is happening in the system because
if they are doing that, there will be millions
and billions of logs from each endpoint.
They will never be able to manage
with all the volume of the activities that's happening.
So you do lots of filtering
and all of these activities,
and only monitoring, only log
what's really, really important,
what's really represents an attack.
Also, in your dashboard,
there's so many events that's actually there,
even though they are filtering a lot, there is still lots
of data that's being logged from each endpoint
and the SOC team only looking for the top 50%
of log events or the top 80% or the top, even 30%,
whatever they are able to, to manage with.
And you don't go much deeper than that.
And because of that, the attackers actually
use this to have lots of different ways, different
and other ways to achieve what they want to achieve,
and they go through using different techniques
that does not being logged enough,
being filtered out mostly by the EDR,
or have a very loose core when it's being actually locked.
So, example of that, that they will not use this way
of downloading the file, but they will use a BitsTransfer,
they will not use the normal download or the normally one
but they use BitsTransfer, or rather than
inject inside a program and execute a thread there,
so they do a process injection
actually executing the malware inside the legitimate,
another legitimate application
which is something that is very high
when it comes to alerts,
they can go through and execute the code
through a different channel through a different way.
That's not being locked enough or not, or is being used
by so many other applications in a legitimate way.
So, rather than injecting a big chunk
of data that looks like a malicious code,
they inject in a very small pieces rather
than use create remote thread
which is a known Windows command that attacker that's
the EDR is mostly sitting a high alert on it.
They can use other techniques
like a central context or other ways to execute their data.
So, with that being said, there's so many ways to bypass,
and the question comes, so how I can detect all of that?
How I can detect there's actually my endpoint
has been bypassed and there's lots of things happening.
Here's the thing.
If you really want to have an effective incident response
or effective threat hunting or effective detections,
you need to get into the raw data.
Whatever the tools you are using,
they cannot log enough information that you can
see in yourself or in your tools or in your dashboards.
These products and whatever the next line of products
that use AI or whatever, they will always hide
so many events is happening on the endpoint.
What is it something that is suspicious?
Don't go into analyze it more logs.
Yeah, that's a good three-ish phrase.
But the most important is to dive deeper into the raw data.
If you want to carry on a threat hunting assessment
then go into the raw data,
take your memory dump, investigate the memory,
even execute some code by partially collect cells
for information, use cancer platform that collects lots
of volatile and non-volatile information
and analyze this information.
You can take many dumps of different process
and analyze this memory, see if
there's anything suspicious that is happening.
There's suspicious threads,
there's codes is being scripted, not in the right place
or not inside the actual pro application data,
there is a memory located that look suspicious.
There are different suspicious strings
or suspicious things happening inside the memory.
The EDR is being unhooked
or being removed out of this process and so on.
You need to dive deeper into the actual memory,
seeing what's happening.
You can do that by memory forensics, as we said,
or through using some of the incident response,
frameworks like cancer, for example, to collect information,
take memory dumps for different process
and analyze them yourself.
Hope that video is useful answering the next video.
Bye-bye.