## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
However, it should be noted that the HTA attack was blocked due to the applied policy of blocking execution of all HTA files; see Figure 6.9

#### 4.6.3 Exe-Dll

Both the EXE- and DLL-based attacks were successfully executed without being identified by the EDR nor producing any telemetry. ### Sentinel One

Sentinel One has sophisticated AI-based behavioral analysis features that make stealth infiltration and tool execution rather difficult. Among others, Sentinel One collects ETW telemetry and monitors almost all parts of the system. It uses kernel callbacks to collect information, such as process creation, image load, thread creation, handle operations, and registry operations. It also produces detailed attack paths and process tree graphs. Our results indicate that the Sentinel One has severe issues in handling PowerShell-based post-exploitation activities. Thus, one could easily run tools, such as PowerView, using the powershell command of Cobalt Strike and some IEX cradles. Figure 4:0 McAfee Endpoint Protection blocking the HTA attack. Figure 4:1 An excerpt of the settings that were enabled in McAfee Endpoint Protection. #### 4.7.1 Enabled Settings

For this solution, we decided to enable all the features needed using the buttons in the console to use its engines, including static and behavioral AI, script, lateral movement, fileless threat detection, etc. Moreover, we enabled all the features Deep Visibility provides apart from the full disk scan and data masking. We also chose to kill processes and quarantine the files. #### 4.7.2 Exe-Hta-Cpl

Notably, none of these attack vectors issued an alert to Sentinel One. #### 4.7.3 Dll

As soon as the folder with the MS-Teams installation touched the disk, an alert was triggered, indicating that the malicious DLL was unsigned, and this could be a potential risk. As it can be observed in Figure 17, the high entropy of our DLL was detected as an IoC. The IoC was correct as our shellcode was AES encrypted. It should be noted that previous experiments with Sentinel One with low entropy files (using XOR encoding) passed the test without any issues, implying that the actual issues were due to the high entropy of the DLL. #### 4.7.1 Anonymalities

This binary contains abnormal section names which could be an indication that it was created with non-standard development tools. #### 4.7.2 Hiding/Stealthiness

The majority of sections in this PE have high entropy, a sign of obfuscation or packing. This binary may contain encrypted or compressed data as measured by high entropy of the sections (greater than 6.8). #### 4.7.3 General

This binary imports functions used to raise kernel exceptions. Figure 4:2 Sentinel One reporting the DLL attack. ### Sophos Intercept X with EDR

Sophos Intercept is one of the most well-known and trusted AVs/EDRs. It has been previously used as a test case for user-mode hook evasion ([[https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/](https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/)]([https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/](https://www.mdsec.co.uk/2020/08/firewalker-a-new-approach-to-generically-bypass-user-space-edr-hooking/)) accessed on 8 July 2021). The EDR version provides a complete view of the incidents and really detailed telemetry, as well as a friendly interface with insightful graphs. Some of its features can be seen Figure 4:3

#### 4.8.1 Enabled Settings

In the case of Sophos, the configuration was simple and intuitive for the user. Therefore, we enabled all offered features, which provided protection without usability issues. #### 4.8.2 Exe

This was the only vector that worked flawlessly against this EDR. In fact, only a small highlight event was produced due to its untrusted nature because it was not signed. PPID spoofing worked, and no alerts were produced, but the activities of **werfault.exe** were logged by Sophos, e.g., the connection to our domain.