AV / EDR Considerations
Lab and authorised engagements only. We focus on how EDR and AV detect attacker tooling so blue teams can tune detections and red teams (with signed RoE) can write reports defenders trust.
Detection-engineering perspective
EXAMPLE
# AV/EDR detection - defender perspective > Lab + authorised engagements only. This page is detection-oriented: it > describes how endpoint tools recognise suspicious behaviour so defenders > can tune and validate them. We do not publish step-by-step evasion > recipes; signed Rules of Engagement (RoE), scoped consent, and customer > approval are required before any live testing. ## What modern EDR actually watches - Process tree anomalies: office app spawning powershell, mshta, wscript - Suspicious parent/child: services.exe spawning unknown binaries - LOLBins: certutil, bitsadmin, regsvr32, mshta, rundll32 used for download or proxy execution - In-memory behaviour: VirtualAlloc + WriteProcessMemory + CreateRemoteThread sequences - AMSI and ETW telemetry from PowerShell, .NET, and WMI - Network behaviour: beacons on long jitter intervals, low-entropy or DGA-shaped DNS ## Detection signals that catch common evasion attempts - Unsigned or rare binaries running from %TEMP%, %APPDATA%, AppData\\Local\\Temp - New scheduled task or service created by a non-admin or interactive process - Token manipulation: SeDebugPrivilege, SeImpersonatePrivilege use by user-launched code - Sudden DLL loads into LSASS, lsm, or csrss - Process hollowing patterns: a suspended child with replaced image base ## What blue teams should tune - Build allowlists for office-spawned interpreters - block by default, alert always - Surface signed-but-rare: Authenticode signed is not Authenticode trusted - Use Sysmon config (SwiftOnSecurity, Olaf Hartong) and forward to a SIEM - Test AV/EDR against MITRE Caldera or Atomic Red Team in a lab - Run purple-team exercises so detection rules survive realistic noise ## Reporting on a red-team engagement - Capture timestamps, hashes, parent/child PIDs for everything the EDR caught and missed - Recommend tuning, not just findings - defenders want next steps - Pair each finding with at least one detection or hardening suggestion - Never leave persistence in place; document and remove
Why it matters
Good AV/EDR posture is layered: prevention + detection + response. The blue-team value of a red team exercise is the detection rules that survive. Pen testers should optimise reports for what defenders can change Monday morning, not for the cleverest tradecraft.
Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.
Example
Example
# Out of scope for this beginner track. # Knowing AV / EDR exists shapes how engagements are planned: # - Tell the SOC when you're testing (or don't, if doing a purple-team). # - Track which alerts your activity does and doesn't generate — that's the value. # We don't ship custom evasion payloads here.Try it Yourself »
Discussion
Loading…