## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
See Figure 4:4

Figure 4:5 The settings for Sophos. #### 4.8.3 DLL

Unfortunately, the malicious DLL could not be loaded, yet the EDR produced no alert. Interestingly, the application was executed normally without the DLL in the folder. We assume that there might be some interference due to the EDR's process protection features as the payload was functioning normally. #### 4.8.4 CPL

As soon as the.cpl file was executed, an alert was produced, the process was blocked, and the attack path in Figure 20 was created. As it can be observed, detailed telemetry was produced about the system's activities. Figure 4:6 Executable was able to run the shellcode and connect to the C2. Figure 4:7 CPL was blocked by Sophos. Details and graph. #### 4.8.5 HTA

As soon as the iexplore.exe visited and downloaded the hta file, its actions were blocked, and detailed attack telemetry was produced once again. See Figures 21 and 22. ### _Syntantec Endpoint Protection_

Syntantec Endpoint Protection is a well-known solution and among the most used ones in multiple industries. It combines a highly sophisticated static detection engine with emulators. The latter considers anti-evasion techniques, addressing packed malware obfuscation techniques, and detects the malware that is hidden inside even custom packers. Symantec Endpoint Protection uses a machine learning engine to determine whether a file is benign or malicious through a learning process. Symantec Security Response trains this engine to recognize malicious attributes and defines the machine learning engine's rules to make detections. Symantec leverages its cloud service to confirm the detection that the machine learning engine made. To protect endpoint devices, it launches a specially anti-malware mechanism on startup, before third-party drivers initialize, preventing the actions of malicious drivers and rootkits, through an ELAM driver ([[https://docs.microsoft.com/en-us/windows-hardware/drivers/install/elam-driver-requirements](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/elam-driver-requirements)]([https://docs.microsoft.com/en-us/windows-hardware/drivers/install/elam-driver-requirements](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/elam-driver-requirements)) accessed on 8 July 2021). The EDR is highly configurable and easy to adapt to everyday enterprise life, with a powerful HIDS and network monitoring which enable it to identify and block network-based lateral movement, port scans, as well as common malware network behavior, e.g., meterpreter's default HTTPS communication. Figure 4:8 HTA was blocked by Sophos. Details and graph. Figure 4:9 Network connections to our domain as logged by Sophos. #### 4.9.1 Enabled Settings

We enabled the default features using the default levels of protection. They were enough to provide adequate protection without causing issues. #### 4.9.2 HTA

In our attacks, Symantec Endpoint Protection managed to identify and block only the HTA attack; see Figure 5:0 However, no alert was raised to the user. #### 4.9.3 Cpl-Exe-Dll

All three attack vectors (CPL, EXE, and DLL) were successful, without the EDR identifying, blocking them, or producing any alert. ### Trend Micro Apex One

Apex One is a well-known solution and ranked among the top ones on Gartner's table. Its overall features, beyond the basic protection and firewall capabilities, include predictive machine learning, and it can also be used for offline protection. The lightweight, offline model helps to protect the endpoints against unknown threats even when a functional Internet connection is not unavailable. Security Agent policies provide increased real-time protection against the latest fileless attack methods through enhanced memory scanning for suspicious process behaviors. Security Agents can terminate suspicious processes before any damage can be done.