## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
In this case, it keeps track of the thread ID, extracts the full injected memory and parses the.text section, the Exports section, the PE header, the DOS header and displays the name of the PE, start/stop date/time, not limited to the export address of the loaded function. As for the response part, it provides extensive real-time response capabilities and allows the creation of custom IOAs based on process creation, network connections, and file creation, among others. #### 4.2.1 Enabled Settings

For this EDR, we used an aggressive policy enabling as much features as possible. It was a policy already used in a corporate environment with its goal being maximum protection and minimum disruption. #### 4.2.2 Dll-Cpl-Hta

None of these three attack vectors produced any alerts and allowed the Cobalt Strike beacon to be executed covertly. #### 4.2.3 Exe

Quite interestingly, the EXE was detected, although direct system calls were used to bypass user-mode hooking. Note that the alert is of medium criticality. In addition, please note the spoofed parent process in Figure 8.

Figure 7: The findings of Carbon Black for the EXE and DLL attack vectors. ### Eset Protect Enterprise

ESET PROTECT Enterprise is a widely used EDR solution that uses behavior and reputation systems to mitigate attacks. Moreover, it uses cloud sandboxing to prevent zero-day threats and full disk encryption for enhanced data protection. The EDR uses real-time feedback collected from million of endpoints using, among others, kernel callbacks, ETW (Event Tracing for Windows), and hooking. ESET PROTECT Enterprise allows fine-tuning through editing XML files and customizing policies depending on users and groups. For this, blue teams may use a file name, path, hash, command line, and signers to determine the trigger conditions for alerts. We used ESET PROTECT Enterprise with the maximum available predefined settings, as in Figure 9, without further fine tuning. #### 4.3.1 Enabled Settings

For this EDR, we used the predefined policy for maximum security, as stated by ESET in the console. This makes use of machine learning, deep behavioral inspection, SSL filtering, and PUA detection, and we decided to hide the GUI from the end user. #### 4.3.2 Exe-Dll

Both these attack vectors were successfully executed, without the EDR blocking and reporting any alert; see Figure 10.

#### 4.3.3 Cpl-Htta

The CPL and HTA attacks were correctly identified and blocked by ESET PROTECT Enterprise; see Figures 11 and 12, respectively. It should be noted that the memory scanner of ESET correctly identified malicious presence but falsely named the threat as Meterpreter. Figure 8: CrowdStrike catching the ‘Early-Bird’ injection despite the use of direct syscalls. Figure 6.0 Bypassing ESET PROTECT Enterprise with the EXE and DLL attacks. Figure 6.1 ESET PROTECT Enterprise settings. ### F-Secure Elements Endpoint Detection and Response

F-Secure Elements EDR collects behavioral events from the endpoints, including file access, processes, network connections, registry changes, and system logs. To achieve this, the EDR uses Event Tracing for Windows. While F-Secure Elements EDR uses machine learning for correlating information, human intervention from cyber-security experts

Figure 6.2 ESET PROTECT Enterprise detects the HTA attack. Figure 6.3 ESET PROTECT Enterprise detects the CPL attack. is often used. The EDR also features built-in incident management. Moreover, after a confirmed detection, F-Secure Elements EDR has built-in guidance to facilitate users in taking the necessary steps to contain and remediate the detected threat. Enabled Settings

In terms of our experiments, all features were enabled, including DeepGuard. We also included browsing control based on reputation, and the firewall was up and running.