Presentation on EDR bypasses and relevant offensive and defensive techniques

I will evaluate MITRE ATT&CK specific to EDR bypasses, using a context of a real attack and data breach, highlighting the relevant MITRE D3F3ND technique, for your blue team.

1. EDR BYPASS
AND LIMITATIONS
By : Carlo Dapino
License Type: CC BY-NC-ND 4.0
https://creativecommons.org/licenses/by-nc-nd/4.0/

2. OBFUSCATED FILES OR INFORMATION (T1027)
EXAMPLE: IN 2021, THE CONTI RANSOMWARE GANG (A RAAS PLATFORM) WAS KNOWN FOR USING
OBFUSCATED PAYLOADS TO HIDE THEIR MALWARE FROM TRADITIONAL SECURITY TOOLS.
CRIMINAL PLATFORM: CONTI RAAS PLATFORM, NOTORIOUS FOR DISTRIBUTING OBFUSCATED
RANSOMWARE ACROSS VARIOUS ORGANIZATIONS.
TOOLS: TOOLS LIKE VEIL AND HYPERION ARE COMMONLY USED TO OBFUSCATE MALICIOUS FILES
AND SCRIPTS, HELPING ATTACKERS EVADE DETECTION.
MITIGATION: USE ADVANCED DETECTION MECHANISMS AND REGULAR CODE SCANNING FOR
OBFUSCATED FILES.
DEFENSE REFERENCE (MITRE D3FEND): DFD0007 - OBFUSCATED FILE ANALYSIS: DE-
OBFUSCATION TECHNIQUES TO ANALYZE CODE FOR HIDDEN THREATS.Copyright 2024 - Carlo Dapino

3. Copyright 2024 - Carlo Dapino CODE INJECTION (T1055)
EXAMPLE: RYUK RANSOMWARE USES DLL INJECTION TO EVADE EDR BY EXECUTING CODE WITHIN
LEGITIMATE SYSTEM PROCESSES.
CRIMINAL PLATFORM: RYUK RAAS.
TOOLS: METASPLOIT AND COBALT STRIKE FOR CODE INJECTION.
DEFENSE REFERENCE : DFD0009 - CODE INJECTION DETECTION: MONITOR PROCESSES FOR
SUSPICIOUS MEMORY MODIFICATIONS.

4. Copyright 2024 - Carlo Dapino DISABLING OR MODIFYING SECURITY SOFTWARE (T1562)
EXAMPLE: THE REVIL RANSOMWARE GROUP DISABLED EDR AND ANTIVIRUS SOFTWARE USING
SYSTEM VULNERABILITIES.
CRIMINAL PLATFORM : REVIL RAAS.
TOOLS: PROCESS HACKER TO DISABLE SECURITY SOFTWARE.
DEFENSE REFERENCE: DFD0012 - SOFTWARE CONFIGURATION MONITORING: TRACK CHANGES TO
SECURITY TOOLS, ENABLING SELF-PROTECTION MECHANISMS.

5. Copyright 2024 - Carlo Dapino LIVING OFF THE LAND (LOLBINS) (T1218)
EXAMPLE: FIN7 USED POWERSHELL AND WMIC TO EXECUTE MALICIOUS PAYLOADS WITHOUT
NEEDING TO DROP NEW EXECUTABLE FILES.
CRIMINAL PLATFORM: FIN7 GROUP.
TOOLS: POWERSHELL AND WMIC AS LEGITIMATE TOOLS LEVERAGED FOR MALICIOUS INTENT.
DEFENSE REFERENCE: DFD0016 - APPLICATION EXECUTION PREVENTION: RESTRICT ACCESS TO
POTENTIALLY DANGEROUS SYSTEM TOOLS.

6. Copyright 2024 - Carlo Dapino PROCESS DOPPELGÄNGING (T1055.013)
EXAMPLE: NOTPETYA USED PROCESS DOPPELGÄNGING TECHNIQUES TO EXECUTE MALWARE
WITHOUT WRITING IT TO DISK.
CRIMINAL PLATFORM : NOTPETYA (NATION-STATE LEVEL OPERATIONS).
TOOLS: DOPPELGÄNGER TOOLS FOR FILELESS MALWARE EXECUTION.
DEFENSE REFERENCE : DFD0009 - PROCESS INJECTION DETECTION: ADVANCED MEMORY
FORENSICS TO DETECT CODE INJECTIONS INTO LEGITIMATE PROCESSES.

7. Copyright 2024 - Carlo Dapino VIRTUALIZATION/SANDBOX EVASION (T1497)
EXAMPLE: MAZE RANSOMWARE DETECTED SANDBOX ENVIRONMENTS AND DELAYED EXECUTION
TO AVOID EARLY DETECTION.
CRIMINAL PLATFORM: MAZE RAAS.
TOOLS: PARANOID FISH FOR VIRTUAL MACHINE DETECTION.
DEFENSE REFERENCE : DFD0018 - VIRTUALIZATION EVASION DETECTION: HARDEN SANDBOX AND
VIRTUAL ENVIRONMENTS TO PREVENT DETECTION.

8. Copyright 2024 - Carlo Dapino MASQUERADING (T1036)
EXAMPLE: SOLARWINDS ATTACKERS DISGUISED MALICIOUS UPDATES AS LEGITIMATE SOFTWARE
UPDATES TO EVADE DETECTION.
CRIMINAL PLATFORM: APT29 (LINKED TO STATE-SPONSORED GROUPS).
TOOLS: BATCHOBFUSCATOR TO MODIFY FILE NAMES AND METADATA TO EVADE DETECTION.
DEFENSE REFERENCE: DFD0014 - FILE METADATA MONITORING: ANALYZE AND VERIFY FILE
METADATA FOR CONSISTENCY AND AUTHENTICITY.

9. GPU MEMORY?
BROWSER SANDBOXES?
(SEE MAGECART ALIKE)
WEB ASSEMBLY?
RUST AND LANGUAGES COMPILED ON
THE FLY ALIKE?
MOBILE PLATFORMS? Copyright 2024 - Carlo Dapino

10. Copyright 2024 - Carlo Dapino