## 3 Experimental Setup
### Code Analysis
#### 3.2.3 DLL Sideloading
As attackers, once high integrity is achieved, one may effectively attack the EDRs in various ways, including patching the ETWTi functions of Defender for Endpoints and removing callbacks of the Sophos Intercept X to execute hacking tools and remain uninterrupted. Note that our goal during the following POCs was not to raise any alert in the EDR consoles, something that was successfully achieved. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**EDR** & **CPL** & **HTA** & **EXE** & **DLL** \\ \hline Carbon Black & \(\bullet\) & ✗ & ✓ & ✓ \\ \hline CrowdStrike Falcon & ✓ & ✓ & \(\bullet\) & ✓ \\ \hline ESET PROTECT Enterprise & ✗ & ✗ & ✓ & ✓ \\ \hline F-Secure Elements Endpoint Detection and Response & ✓ & ✓ & ✓ & ✓ \\ \hline Kaspersky Endpoint Detection and Response & ✗ & ✗ & ✗ & ✓ \\ \hline McAfee Endpoint Protection & ✗ & ✗ & ✓ & ✓ \\ \hline Sentinel One & ✓ & ✓ & ✓ & ✗ \\ \hline Sophos Intercept X with EDR & ✗ & ✗ & ✓ & - \\ \hline Symantec Endpoint Protection & ✓ & ✗ & ✓ & ✓ \\ \hline Trend micro Apex One & ✓ & \(\circ\) & ✓ & ✓ \\ \hline Windows Defender for Endpoints & ✗ & ✗ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Aggregated results of the attacks for each EDR. Notation: ✓: Successful attack, \(\bullet\): Successful attack, raised minor alert, \(\star\): Successful attack, alert was raised \(\circ\):Unsuccessful attack, no alert raised, ✗: failed attack, alerts were raised. Figure 30: Timeline events for DLL sideloading by ATP. ### Attacking Defender for Endpoints

In what follows, we present two attacks, both executed manually using WinDBG. To circumvent the Patch Guard protection mechanism, we performed all actions quickly to avoid introducing _noise_ that could trigger the EDR. Note that the EDR was in passive mode for this test since we are only interested in silencing the produced alerts. #### 5.1.1 Manually Patching Callbacks to Load Unsigned Drivers

In this case, our process will be manually patching some of the contents of the PspLoadImageNotifyRoutine global array, which stores the addresses of all the registered callback routines for image loading. By patching the callback called SecPsLoadImageNotify, which is registered with the mssecflt.sys driver, we are essentially blinding the EDR as far as loading of drivers is concerned. It is important to note here how the EDR detects whether the Driver Signature Enforcement (DSE) is disabled. Strangely, the alert about a possibly disabled DSE is triggered once an unsigned driver is loaded. Therefore, the ATP assumes that, since an unsigned driver has been loaded, the DSE was disabled. See Figure 31.

Then, after the callback is patched, we will zero-out the g_CiOptions global variable whose default value is 0x6, indicating that DSE is on. Then, we load our driver using the OSR driver loader utility. Afterwards, we reset the g_CiOptions variable and the patched callback to avoid a possible bug check by Patch Guard and, thus, our system crashing. See Figure 32.

#### 5.1.2 Manually Patching an ETWTi Function to Dump LSASS without Alerts

In this POC, we manually patch the EtwTiLogReadWriteVm function, see Figure 33, which is responsible for the telemetry of the NtReadVirtualMemory syscall, which is called from MiniDumpWriteDump which is used by many Local Security Authority Subsystem Service (LSASS) dumping tools. We are using the Outflank-Dumpert tool [19] to dump the LSASS memory that uses direct syscalls, which may evade most common EDRs but not ATP; see Figure 34.

Find below the procedure we followed to achieve an 'undercover' LSASS dump. Note how we convert the virtual address to the physical address to execute our patch successfully. This is because this is a read-only page we want to write at, and any forced attempt to write there will result in a _blue screen of death_. However, we may write on the physical address without any trouble. Notably, while timeline events will most likely be produced, no alert will be triggered that will make SOCs

Figure 31: DSE Alert by ATP. Telemetry Sourcerer driver detection.