## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
In addition, the feeds can be query-based, meaning that alerts will be produced based on results yielded by searches based on the events that Carbon Black processes, including but not limited to, registry modifications, network connections, and module loadings. This EDR relies heavily on kernel callbacks and a lot of its functionalities reside in its network filtering driver and its file system filtering driver. For several detections, user-mode hooks are also used. As an example, consider the detection of memory dumping (DUMP_PROCESS_MEMORY). As mentioned in Carbon Black's documentation, userland API hooks are set to detect a process memory dump. Another example is the detection of script interpreters loaded into memory (HAS_SCRIPT_DLL). As mentioned in the documentation, a driver routine is set to identify processes that load an in-memory script interpreter. #### 4.1.1 Enabled Settings

Carbon Black Response is different in terms of logic and use case. Its main purpose is to provide telemetry and not to proactively act. Moreover, its scope is to assist during an investigation as it does not include blocking capabilities but is an SOC-friendly software that gives in-depth visibility. Its power is closely related to the person behind the console as, beyond triaging hosts, its detection rely on feeds that can be customized and produce

Figure 3: Using Process Explorer to find hijackable DLLs. alerts. In our case, we used some default feeds, such as ATT&CK feed and Carbon Black's Community Feed, as well as a custom corporate feed. #### 4.1.2 Cpl

As illustrated in Figure 4, an alert was triggered due to the abnormal name, location, and usage of Shell32.dll. Carbon Black is well aware of malicious.cpl files in this case, but it cannot clearly verify whether this activity is indeed malicious. Therefore, the event is reported with a _low_ score. Figure 5 illustrates, on the right side, the IOCs that were triggered. #### 4.1.3 HTA

The.hta file was detected due to its parent process as a possible CVE and for a suspicious loaded module. Carbon Black is aware of both LOLBAS and LOLBINS and detected it in a timely manner, see Figure 6.

#### 4.1.4 EXE-DLL

Regarding the other two attack vectors, no alerts were raised. Nevertheless, their activity was monitored normally and produced telemetry that the host communicates, despite being able to communicate successfully to our domain. Finally, it should be noted

Figure 4: All alerts produced in Carbon Black. Figure 5: CPL’s IOCs produced by Carbon Black. Figure 6: Carbon Black findings for HTA. that the PPID spoofing did not succeed against Carbon Black. Results may be seen is Figure 7.

### CrowdStrike Falcon

CrowdStrike Falcon combines some of the most advanced behavioral detection features with a very intuitive user interface. The latter provides a clear view of the incident itself and the machine's state during an attack through process trees and indicators of attacks. Falcon Insight's kernel-mode driver captures more than 200 events and related information necessary to retrace incidents. Besides the classic usage of kernel callbacks and user-mode hooks, Falcon also subscribes to ETWTi ([[https://www.reddit.com/r/crowdstrike/comments/n961b/interesting_stuff/gxq0t1t](https://www.reddit.com/r/crowdstrike/comments/n961b/interesting_stuff/gxq0t1t)]([https://www.reddit.com/r/crowdstrike/comments/n961b/interesting_stuff/gxq0t1t](https://www.reddit.com/r/crowdstrike/comments/n961b/interesting_stuff/gxq0t1t)) accessed on 8 July 2021). When it comes to process injections, most EDRs, including Falcon, continuously check for Windows APIs like VirtualAllocEx and NtMapViewOfSection prior to scanning the memory. Once Falcon finds any of these called by any process, it quickly checks the allocated memory and whether this was a new thread created from a remote process.