Defense Evasion

Overview

Modern Endpoint Detection and Response (EDR) solutions represent the most significant challenge for red team operations. These tools employ multiple detection layers—userland hooking, kernel callbacks, behavioral analysis, and machine learning—creating a sophisticated defense matrix that operators must understand and navigate.

Defense evasion is not about "hacking past security"—it's about demonstrating realistic adversary capabilities to help organizations understand their true security posture. Blue teams use this knowledge to identify detection gaps and improve their defenses.

EDR Evasion Techniques

• EDR Evasion Techniques - Comprehensive guide to bypassing endpoint detection and response systems

Detection Mechanisms to Evade

Userland Hooking

EDRs inject DLLs into processes to intercept API calls:

Kernel-Level Monitoring

• Kernel callbacks - Process/thread creation, image loading
• Minifilter drivers - File system operations
• ETW providers - System-wide event tracing
• AMSI - Script and memory content scanning

Behavioral Analysis

• Suspicious parent-child process relationships
• Command-line argument anomalies
• Memory allocation patterns (RWX)
• Network connection timing and destinations

Evasion Categories

Process Injection Techniques

Classic Injection

// Standard injection pattern (heavily detected)
VirtualAllocEx() → WriteProcessMemory() → CreateRemoteThread()

Advanced Techniques

• Process Hollowing - Replace legitimate process image
• Thread Hijacking - Hijack existing threads
• APC Injection - Queue user-mode APCs
• Early Bird - Inject before process initialization
• Module Stomping - Overwrite legitimate DLL

API Hooking Bypass

Direct Syscalls Bypass userland hooks by calling syscalls directly:

// Instead of calling NtAllocateVirtualMemory through ntdll.dll
// Call the syscall directly
mov r10, rcx
mov eax, [syscall_number]  // e.g., 0x18 for NtAllocateVirtualMemory
syscall

NTAPI Unhooking Restore original ntdll.dll bytes to remove EDR hooks:

1. Map fresh copy of ntdll.dll from disk
2. Compare .text sections
3. Restore original bytes

Memory Evasion

• Reflective DLL Loading - Load DLLs without LoadLibrary
• Module Overloading - Hide code in legitimate DLL space
• Heap Encryption - Encrypt sensitive data in memory
• RX Memory - Avoid RWX allocations

Obfuscation Techniques

Payload Obfuscation

• AES/XOR encryption of shellcode
• String encryption and runtime decryption
• Control flow obfuscation
• API hashing for dynamic resolution

Signature Evasion

• Custom packers and crypters
• Metamorphic code generation
• Timestamp manipulation
• Rich header modification

Living Off the Land (LOLBAS)

Abuse trusted Windows binaries to evade detection:

OPSEC Considerations

Network Traffic

• Protocol Blending - Use HTTPS, DNS, or legitimate services
• Domain Fronting - Hide C2 behind CDN domains
• Traffic Timing - Match normal business hours patterns
• Jitter - Randomize callback intervals

Host Artifacts

• Memory-Only Operations - Avoid writing to disk
• Log Management - Selective log clearing (with caution)
• Timestomping - Modify file timestamps
• Process Masquerading - Spoof process names and paths

Behavioral OPSEC

• Parent Process Spoofing - Legitimate process trees
• User Behavior Mimicry - Match normal user activity
• Rate Limiting - Avoid rapid automated actions
• Working Hours - Operate during business hours

Testing Your Evasion

Detection Testing

1. Test payloads against target EDR in lab
2. Use tools like DefenderCheck
3. Analyze EDR telemetry in test environment
4. Iterate on evasion techniques

Common Mistakes

• Using public tools without modification
• Ignoring behavioral detection
• Overlooking network indicators
• Testing only against Defender

Essential Tools

Related Resources

• Sliver C2 - Modern C2 framework with evasion features
• Windows Security - Windows privilege escalation
• Active Directory - Post-exploitation in AD
• DLL Injection - Code injection techniques

References

• MITRE ATT&CK - Defense Evasion
• LOLBAS Project
• Elastic EDR Rules