## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
Enhanced scan features can identify and block ransomware programs that target documents that run on endpoints by identifying common behaviors and blocking processes commonly associated with ransomware programs. You can configure Security Agents to submit file objects containing previously unidentified threats to a Virtual Analyzer for further analysis. After assessing the objects, Virtual Analyzer adds the objects it determined to contain unknown threats to the Virtual Analyzer Suspicious Objects lists and distributes the lists to other Security Agents throughout the network. Finally, Behavior Monitoring constantly monitors endpoints for unusual modifications to the operating system and installed software. According to our research, Apex One uses network, kernel callbacks, and hooking; in both kernel and usermode, ETW, and AMSI to perform behavioral detection. More specifically, for ETW, Apex One uses a data collector called TMSYSEVT_ETW. #### 4.10.1 Enabled Settings

In Apex One, we leveraged as much features as possible that were presented in the policy editor, such as the EDR's smart scanning method, intelliscan, scanning of compressed files, OLE object scanning, intellitrap (a feature used to combat real time compression of malware), ransomware protection (behavioral protection against ransomware, not needed for our tests), anti-exploit protection, monitoring of newly encountered programs, C&C traffic filtering, and, of course, predictive machine learning. Finally, we configured the EDR to block all malicious behavior. Figure 5:1 Identified and blocked HTA attack from Symantec Endpoint Protection. #### 4.10.2 Exe-Dll

Both EXE and DLL attacks were successfully launched. Apex One did not identify nor block them, and no alerts were raised by the EDR. #### 4.10.3 Cpl-Hta

While the HTA attack was launched, Apex One identified the threat and blocked it; however, it did not raise any alert, as shown in Figure 5:2 On the contrary, the CPL attack was detected, blocked, and triggered the proper alert; see Figure 5:3

### Windows Defender for Endpoints (ATP)

Windows Defender for Endpoints is heavily kernel-based, rather than user-based, which allows for great detection capabilities. The beauty of MDATP lies in the fact that most of the detection capability lies in Windows itself, albeit not utilized unless the machine is onboard. For these tests, the EDR was set to block mode to prevent instead of merely detecting. Its telemetry sources include kernel callbacks utilized by the WdFilter.sys mini-filter driver. As previously mentioned, callbacks are set to \"intercept\" activities once a condition is met, e.g., when module is loaded. As an example of those, consider:

* PsSetCreateProcessNotifyRoutine(Ex)-Process creation events. * PsSetCreateThreadNotifyRoutine-Thread creation events. * PsSetLoadImageNotifyRoutine-Image(DLL/Driver) load events. * CmRegisterCallback(Ex)-Registry operations. * ObRegisterCallbacks-Handle operations(Ex: process access events). * FltRegisterFilter-I/O operations(Ex: file system events). They also include a kernel-level ETW provider rather than user-mode hooks. This comes as a solution to detecting malicious API usage since hooking the SSDT (System Service Dispatch Table) is not allowed, thanks to Kernel Patch Protection (KPP) PatchGuard (PG). Before moving on, we should note a different approach taken by Kaspersky: to hook the kernel, it made use of its own hypervisor. Since Windows 10 RS3, the NT kernel is instrumented using EtwTi functions for various APIs commonly abused for process injection, credential dumping, etc., and the telemetry available via a secure ETW channel ([[https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection](https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection)]([https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection](https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection)) accessed on 8 July 2021).