Organizations are spending billions on malware defense that’s easy to bypass

guest · Sep 3, 2022

Two of the simplest forms of evasion are surprisingly effective against EDRs.
By Dan Goodin @dangoodin001 - August 30, 2022

Last year, organizations spent $2 billion on products that provide Endpoint Detection and Response, a relatively new type of security protection for detecting and blocking malware targeting network-connected devices. EDRs, as they're commonly called, represent a newer approach to malware detection. Static analysis, one of two more traditional methods, searches for suspicious signs in the DNA of a file itself. Dynamic analysis, the other more established method, runs untrusted code inside a secured "sandbox" to analyze what it does to confirm it's safe before allowing it to have full system access.
Click to expand...

EDRs—which are forecasted to generate revenue of $18 billion by 2031 and are sold by dozens of security companies—take an entirely different approach. Rather than analyze the structure or execution of the code ahead of time, EDRs monitor the code's behavior as it runs inside a machine or network.

In theory, it can shut down a ransomware attack in progress by detecting that a process executed on hundreds of machines in the past 15 minutes is encrypting files en masse. Unlike static and dynamic analyses, EDR is akin to a security guard that uses machine learning to keep tabs in real time on the activities inside a machine or network.
Click to expand...

Streamlining EDR evasion
Despite the buzz surrounding EDRs, new research suggests that the protection they provide isn't all that hard for skilled malware developers to circumvent. In fact, the researchers behind the study estimate EDR evasion adds only one additional week of development time to the typical infection of a large organizational network. That's because two fairly basic bypass techniques, particularly when combined, appear to work on most EDRs available in the industry.

"EDR evasion is well-documented, but more as a craft than a science," Karsten Nohl, chief scientist at Berlin-based SRLabs, wrote in an email. "What's new is the insight that combining several well-known techniques yields malware that evades all EDRs that we tested. This allows the hacker to streamline their EDR evasion efforts."
Click to expand...

"Overall, EDRs are adding about 12 percent or one week of hacking effort when compromising a large corporation—judged from the typical execution time of a red team exercise," Nohl wrote.

The researchers presented their findings last week at the Hack in the Box security conference in Singapore. Nohl said EDR makers should focus on detecting malicious behavior more generically rather than triggering only on specific behavior of the most popular hacking tools, such as Cobalt Strike. This overfocus on specific behavior makes EDR evasion "too easy for hackers using more bespoke tooling," Nohl wrote.
Click to expand...

Rasheed187 · Sep 2, 2022

This is a bit of old news, but still quite shocking! And too bad that the names of these companies are not revealed! Remember that the only reason why Win Defender has been improved on Windows is because M$ wanted a piece of the very lucrative EDR market pie.

But it's ridiculous that certain EDR's can be bypassed this easily! No wonder that so many attacks on companies are so succesful. I also have to critizice the Windows OS design, which makes this possible in the first place. But it's no excuse that developers of these EDR's are apparently not aware of these design errors.

moredhelfinland · Sep 5, 2022

I dunno how those EDR solutions were tested? For example, McAfee Endpoint Security, by default, sure uses default settings which are crap. Or course it is an admin(s) job to tighten your fav EDR solution.
For example, for me, i took about two weeks to "tune" my Mcafee Endpoint Security for my environment. After reading hundreds of pages of McAfee Endpoint "Best Practices", forum posts, youtube videos i'm pretty happy what i accomplished.
Was it worth? Yes it was, i've learned a alot, which is always a good to learn something new.

itman · Sep 5, 2022

Rasheed187 said: ↑

And too bad that the names of these companies are not revealed!
Click to expand...

They were in the ARS article:

Nohl and fellow SRLabs researcher Jorge Gimenez tested three widely used EDRs sold by Symantec, SentinelOne, and Microsoft
Click to expand...

Rasheed187 · Sep 7, 2022

itman said: ↑

They were in the ARS article:
Click to expand...

This is weird as hell! Perhaps I had a blackout or something, but I can swear that a couple of days ago I read that the researchers didn't want to mention the name of the tested EDR's? But anyway, shame on Microsoft, SentinelOne and Symantec, all this bragging and boasting about how they can stop most attacks, but completely oblivious against relative simple bypassing methods.

moredhelfinland said: ↑

I dunno how those EDR solutions were tested? For example, McAfee Endpoint Security, by default, sure uses default settings which are crap. Or course it is an admin(s) job to tighten your fav EDR solution.
Click to expand...

I'm guessing that it doesn't matter what settings you are using in the EDR, since they simply fail to spot certain bypassing methods.

Rasheed187 · Sep 30, 2022

Speaking of bragging and boasting, I came across this test where SentinelOne beats Win Defender ATP when it comes to protecting companies against the Carbanak and FIN7 hacking group, pretty interesting video:

https://assets.sentinelone.com/c/microsoft-vid?x=u6040P&lx=wPviVP

Log in or Sign up

Organizations are spending billions on malware defense that’s easy to bypass

guest Guest

Rasheed187 Registered Member

moredhelfinland Registered Member

itman Registered Member

Rasheed187 Registered Member

Rasheed187 Registered Member

Log in or Sign up

Organizations are spending billions on malware defense that’s easy to bypass

guest Guest

Rasheed187 Registered Member

moredhelfinland Registered Member

itman Registered Member

Rasheed187 Registered Member

Rasheed187 Registered Member

Useful Searches