## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
Notably, all of the launched attacks were successful, and F-Secure Elements EDR reported no alerts; see Figure 6.4

### Kaspersky Endpoint Detection and Response-Kedr

Kaspersky's EDR (KEDR) is a highly tunable EDR, collaborating with other endpoint protection systems, even from different vendors. This way, the latter try to address broader attacks, while KEDR focuses on advanced attacks. Beyond the traditional hooking mechanisms, this EDR allows endpoints to use advanced pre-processing and sandboxing, which are more computationally intensive. Moreover, it features tools for incident investigation, proactive threat hunting and attack response. Logs and events are sent to the central node, but further telemetry is sent when deemed necessary by the central node, significantly reducing the central node's overall network and storage cost. Moreover, KEDR uses kernel hooking using a specialized hypervisor. This comes with several downsides as it requires virtualization support ([[https://github.com/iPower/KasperskyHook](https://github.com/iPower/KasperskyHook)]([https://github.com/iPower/KasperskyHook](https://github.com/iPower/KasperskyHook)) accessed on 8 July 2021). #### 4.5.1 Enabled Settings

In our experiments, we enabled all security-related features in every category. However, we did not employ any specific configuration for Web and Application controls. More precisely, we created a policy and enabled all options, including behavior detection, exploit and process memory protection, HIPS, Firewall, AMSI, and FileSystem protection modules. The actions were set to block and delete all malicious artifacts and behaviors. #### 4.5.2 Cpl-Hta-Exe

In the case of CPL, HTA, and EXE attack vectors, KEDR identified and blocked our attacks in a timely manner; see Figure 6.5 More precisely, the EXE and CPL processes were killed after execution, while the HTA was blocked as soon as it touched the disk. Figure 6.6 F-Secure Elements EDR console after launching our attacks reports no security event. #### 4.5.3 Dll

Our DLL attack was successfully launched, and no telemetry was recorded by KEDR. ### McAfee Endpoint Protection

McAfee Endpoint Protection is among the most configurable and friendly to the technical user solutions, it allows reacting to specific process behaviors, i.e., remote memory allocation, but also to proactively eliminate threats by reducing the options an attacker has based on a handful of options, such as blocking program registration to autorun. We decided to leverage this configurability and challenge McAfee to the full extend and only disabled one rule blocking execution from common folders, such as the Desktop folder. The rationale behind this choice is usability since activating this rule would cause many usability issues in an everyday environment. In our experiments, we managed to successfully bypass the restrictions using our direct syscalls dropper and allocate memory remotely, as well as execute it. The latter is an indicator that the telemetry providers and processing of the information is not efficient. #### 4.6.1 Enabled Settings

For this EDR, we decided to challenge McAfee since it offers a vast amount of settings and a lot of option for advanced users, such as memory allocation controls, etc. It was also quite interesting that some policies were created by default to block suspicious activities, such as our HTA's execution. We opted to enable all options without exception, apart from one that was block execution from user folders and would cause issues in a corporate environment. An excerpt of the settings that were enabled is illustrated in Figure 6.7

Figure 6.8 Screenshots from KEDR illustrating the malicious activity that it detected and blocked. #### 4.6.2 HTA-Cpl

Both HTA- and CPL-based attacks were identified and blocked.