## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
Thus, MDATP heavily relies on EtwTi, in some cases even solely, for telemetry. As an example of the ETWTi sensor, consider the alert below Figure 5:4 It is an alert produced by running our EXE payload on a host that ATP is in passive mode. Note that, although our payload uses direct system calls, our injection is detected. Figure 5:5 Detected and blocked CPL attack against Apex One. Due to the fact that the callbacks operate at the kernel level (Ring 0), an attacker needs to have high integrity level code execution in a machine to blind them or render them useless successfully. An attacker may choose any one of the following three techniques to achieve this:

* Zero out the address of the callback routine from the kernel callback array that stores all the addresses. * Unregister the callback routine registered by WdFilter.sys. * Patch the callback routine of WdFilter.sys with a RET(0 xc3) instruction or hook it. Due to the nature of the ETWTi Sensor telemetry, it is not possible to blind the sources from a medium-IL context and needs admin/a high-IL context. Once this is achieved, an attacker may employ any one of the following methods:

* Patch a specific EtwTi function by inserting a RET/0 xc3 instruction at the beginning of the function so that it simply returns without executing further. Not KPP-safe, but an attacker may avoid BSOD-ing the target by simply restoring the original state of the function as soon as their objective is accomplished. In theory, Patch Guard may trigger at any random time, but, in practice, there is an extremely low chance that PG will trigger exactly during this extremely short interval. * Corrupt the EtwTi handle. * Disable the EtwTi provider. #### 4.11.1 Enabled Settings

We enabled all the basic features, including the tamper protection, the block mode option, and auto investigation. Most are handled in the background, and the admins are able to configure connection to intune, which was out of scope. We also enabled file and memory content analysis using the cloud that will upload suspicious files and check them. #### 4.11.2 Cpl-Exe-Hta

Most of these vectors were detected as soon as they touched the disk or were executed. Find the relevant alerts in Figure 5:6

Note that, for the.cpl file, despite the fact that the EDR detected it, it was executed with a fully functional beacon session. See Figure 5:7

Figure 5:8 Alerts produced by ATP in total. Find below the relevant auto-investigation started for this ATP incident, including all the alerts produced. Note that, until successful remediation and full verdict, the investigation may take a lot of time. See Figure 5:9

#### 4.11.3 DLL

The DLL side-loading attack was successful as the EDR produced no alerts nor any suspicious timeline events. Figure 30 illustrates the produced telemetry. Notice the connection to our malicious domain and the uninterrupted loading of our module. Figure 6:0 Details about the alerts produced from ATP. Figure 6:1 Auto investigation by ATP. ### Aggregated Results

Table 1 illustrates an aggregated overview of our findings. Evidently, from the 20 attacks that were launched, more than half of them were successful. It is rather alarming that none of the EDRs managed to detect all of the attacks. More precisely, 10 attacks were completely successful, as they were completed successfully, and no alert was issued; 3 attacks were successful, yet they issued a low significance alert; 1 attack was not successful, yet it did not issue an alert; and 6 attacks were detected and correctly reported by the EDRs. ## 5 Tampering with Telemetry Providers

Apart from finding 'blind spots' for each EDR, there is also the choice of 'blinding' them by tampering with their telemetry providers in various ways. Unhooking user-mode hooks and utilizing syscalls to evade detection is the tip of the iceberg [18]. The heart of most EDRs lies in the kernel itself as they utilize mini-filter drivers to control file system operations and callbacks in general to intercept activities, such as process creation and loading of modules.