## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
Figure 32: Deleting the callback necessary. ### Attacking Sophos Intercept \(X\)

For this EDR, our approach is quite different. We utilize a legitimate and signed driver that is vulnerable, and, by exploiting it, we may access the kernel and load a custom unsigned driver. The tools we will be using are going to be TelemetrySourcerer ([[https://github.com/jthuraisamy/TelemetrySourcerer](https://github.com/jthuraisamy/TelemetrySourcerer)]([https://github.com/jthuraisamy/TelemetrySourcerer](https://github.com/jthuraisamy/TelemetrySourcerer)) accessed on 8 July 2021) that will provide us with the unsigned driver that will actually suppress the callbacks for us, and we will communicate with it through an application that will provide us with a GUI, as well as gdrv-loader ([[https://github.com/akbrn/gdrv-loader](https://github.com/akbrn/gdrv-loader)]([https://github.com/akbrn/gdrv-loader](https://github.com/akbrn/gdrv-loader)) accessed on 8 July 2021) that will exploit the vulnerable driver of Gigabyte and load our driver. Beyond Sophos Intercept X, TelemetrySourcerer can be used in other EDR referred in this work, but, for the sake of simplicity and clarity, we use it only for this EDR use case here.Note that the EDR was in block mode for these tests, but we managed to bypass it and completed our task without raising any alerts; see Figures 35 and 36. Once we suppress all the callbacks by the sophosed.sys driver, the EDR cannot monitor, among others, process creations and filesystem activities. Therefore, one may easily execute arbitrary code on the tools without the EDR identifying them, e.g., one may launch Mimikatz and remain uninterrupted, clearly showing the EDR's inability to'see' it; see Figure 37.

Figure 34: Sample Alert caused by Dumpert. Figure 35: Loading an unsigned driver via gdrv-loader. Figure 30:0 Deleting Sophos’ callbacks via Telemetry Sourcerer’s UI. Nevertheless, the user-mode hooks are still in place. Therefore, tools, like Shellycoat of AQUARMOURY and the Unhook-BOF ([[https://github.com/rsmudge/unhook-bot](https://github.com/rsmudge/unhook-bot)]([https://github.com/rsmudge/unhook-bot](https://github.com/rsmudge/unhook-bot)) last accessed: 8 July 2021), for Cobalt Strike may remove them for a specific process or the beacon's current process; see Figure 30:1

## 6 Conclusions

Throughout this work, we went through a series of attack vectors used by advanced threat actors to infiltrate organizations. Using them, we evaluated state-of-the-art EDR solutions to assess their reactions, as well as the produced telemetry. In this context, we provided an overview for each EDR and the measures used to detect and respond to an incident. Quite alarmingly, we illustrate that no EDR can efficiently detect and prevent the four attack vectors we deployed. In fact, the DLL sideloading attack is the most successful attack as most EDRs fail to detect, let alone block, it. Moreover, we show that one may efficiently blind the EDRs by attacking their core, which lies within their drivers at the kernel level. In future work, we plan to assess positive, false negative, and false positive results produced by different EDRs to measure the noise that blue teams face in real-world scenarios. Moreover, the response time of EDRs will be measured as some EDRs may report attacks with huge delays, even if they have mitigated them. These aspects may significantly impact the work of blue teams and have not received the needed coverage in the literature. Beyond Kaspersky's hooking solution, vendors may opt for other approaches ([[https://github.com/rajiv2790/FalconEye](https://github.com/rajiv2790/FalconEye)]([https://github.com/rajiv2790/FalconEye](https://github.com/rajiv2790/FalconEye)) accessed on 8 July 2021) with possible stability issues. However, most vendors prefer to use cloud sandboxes for analysis as this prevents computational overhead. It should be noted that attackers may use signed drivers and hypervisors, e.g., [PERSON]'s, to launch their attacks and hook the kernel without issues in rootkits.