## 3 Experimental Setup
### Attack Vectors  
We have structured four diverse yet real-world scenarios to perform our experiments, which simulate the ones used by threat actors in the wild. We believe that an empirical assessment of EDRs should reflect common attack patterns in the wild. Since the most commonly used attack vector by APT groups is emails, as part of social engineering or spear phishing, we opted to use malicious attached files which the target victim would be lured to execute them. Moreover, we should consider that, due to the high noise from false positives that EDRs report, it is imperative to consider the score that each event is attributed to. Therefore, in our work, we try to minimize the reported score of our actions in the most detailed setting of EDRs. With this approach, we guarantee that the attack will pass below the radar. Based on the above, our hypothetical threat actor starts its attack with some spear-phishing emails that try to lure the target user into opening a file or follow a link that will be used to compromise the victim's host. To this end, we have crafted some emails with links to cloud providers that lead to some custom malware. More precisely, the attack vectors are the following:  
* A.cpl file: A DLL file which can be executed by double-clicking under the context of the rund1132 LOLBINS which can execute code maliciously under its context. The file has been crafted using CPLRresourceRunner ([[https://github.com/rvrsh3](https://github.com/rvrsh3) ll/CPLRresourceRunner]([https://github.com/rvrsh3](https://github.com/rvrsh3) ll/CPLRresourceRunner) accessed on 8 July 2021). To this end, we use a shellcode storage  
Figure 2: The domain pointing to our C2 Server (**up**) and its categorization (**down**). technique using Memory-mapped files (MMF) [16] and then trigger it using delegates; see Listing 1. * A legitimate Microsoft (MS) Teams installation that will load a malicious DLL. In this regard, DLL side-loading ([[https://attack.mitre.org/techniques/T1574/002/accessed](https://attack.mitre.org/techniques/T1574/002/accessed)]([https://attack.mitre.org/techniques/T1574/002/accessed](https://attack.mitre.org/techniques/T1574/002/accessed)) on 8 July 2021) will lead to a self-injection, thus allowing us to \"live\" under a signed binary. To achieve this, we used the AQUARMQUARY-Brownie ([[https://github.com/slaeryan/AQUARMQUARY](https://github.com/slaeryan/AQUARMQUARY)]([https://github.com/slaeryan/AQUARMQUARY](https://github.com/slaeryan/AQUARMQUARY)) accessed on 8 July 2021). * An unsigned PE executable file; from now on referred to as EXE, that will execute process injection using the \"_Early Bird_\" technique of AQUARMQUARY into verfault.exe. For this, we spoofed the parent of explorer.exe using the PROC_THREAD_ATTRIBUTE_MITGATION_POLICY flag to protect our malware from an _unsigned by Microsoft DLL_ event that is commonly used by EDRs for processes monitoring. * An HTA file. Once the user visits a harmless HTML page containing an IFrame, he will be redirected and prompted to run an HTML file infused with executable VBS code that will load the.NET code provided in Listing 2 and perform self-injection under the context of mshta.exe. ```
mmf=MemoryMappedFile.CreateNew(\"__shellcode\",shellcode.Length,... MemoryMappedFileAccess.ReadWriteExecute); //Createamemoryappedviewaccessorwithread/write/executepermissions.. mmva=mmf.CreateViewAccessor(0,shellcode.Length,MemoryMappedFileAccess.ReadWriteExecute); //WritetheshellcodetotheMMF.. mmva.WriteArray(0,shellcode,0,shellcode.Length); //ObtainapointertoourMMF.. varpointer=(byte*); mmva.SafeMemoryMappedViewHandle.AcquirePointer(refpointer); //CreatefunctiondelegatetotheshellcodeinourMMF.. varfunc=(GetFebDelegate)Marshal.GetDelegateForFunctionPointer(newIntPtr(pointer),... typeof(GetFebDelegate)); //Invoketheshellcode.. returnfunc();
```  
**Listing 1** Shellcode execution code from CPLResourceRunner. In what follows, we solely evaluate EDRs against our attacks.