## 3 Experimental Setup  
In this section, we detail the preparation for our series of experiments to the EDRs. Because our goal is to produce accurate and reproducible results, we provide the necessary code where deemed necessary. To this end, we specifically design and run experiments to answer the following research questions:  
* **RQ1:** Can state-of-the-art EDRs detect common APT attack methods?
* **RQ2:** Which are the blind spots of state-of-the-art EDRs?
* **RQ3:** What information is reported by EDRs and which is their significance?
* **RQ4:** How can one decrease the significance of reported events or even prevent the reporting?  
Using ATT&CK as a knowledge base and model, one can model the behavior of the threat actor that we emulate as illustrated in Figure 1. Due to space limitations, we have opted to use a modified version of the standard ATT&CK matrix and used a radial circular dendrogram.  
In this work, we perform an empirical assessment of the security of EDRs. The selected EDRs were selected based on the latest Gartner's 2021 report ([[https://www.gartner.com/en/documents/4001307/magic-quadrant-for-endpoint-protection-platforms](https://www.gartner.com/en/documents/4001307/magic-quadrant-for-endpoint-protection-platforms)]([https://www.gartner.com/en/documents/4001307/magic-quadrant-for-endpoint-protection-platforms](https://www.gartner.com/en/documents/4001307/magic-quadrant-for-endpoint-protection-platforms)) accessed on 8 July 2021), as we included the vast majority of the leading EDRs in the market. The latter implies that we cover a big and representative market share which, in fact, drives the evolution and innovation in the sector. In our experiments, we opted to use the most commonly used C2 framework, Cobalt Strike ([[https://www.cobaltstrike.com/](https://www.cobaltstrike.com/)]([https://www.cobaltstrike.com/](https://www.cobaltstrike.com/)) accessed on 8 July 2021). It has been used in numerous operations by both threat actors and'red teams' to infiltrate organizations [15].  
Moreover, we used a _mature_ domain; an expired domain with proper categorization that will point to a VPS server hosting our Cobalt Strike team-server. This would cause less suspicion and hopefully bypass some restrictions as previous experience has shown with parked domains and expired domains ([[https://blog.sucuri.net/2016/06/spam-via-expired-domains.html](https://blog.sucuri.net/2016/06/spam-via-expired-domains.html)]([https://blog.sucuri.net/2016/06/spam-via-expired-domains.html](https://blog.sucuri.net/2016/06/spam-via-expired-domains.html)), [[https://unit42.paloaltonetworks.com/domain-parking/](https://unit42.paloaltonetworks.com/domain-parking/)]([https://unit42.paloaltonetworks.com/domain-parking/](https://unit42.paloaltonetworks.com/domain-parking/)) accessed on 8 July 2021). We issued a valid SSL certificate for our C2 communication from _Let's Encrypt_ ([[https://letsencrypt.org/](https://letsencrypt.org/)]([https://letsencrypt.org/](https://letsencrypt.org/)) accessed on 8 July 2021) to encrypt our traffic. Figure 2 illustrates our domain and its categorization.  
Cobalt Strike deploys agents named 'beacons' on the victim, allowing the attacker to perform multiple tasks on the compromised host. In our experiments, we used the so-called _malleable C2 profile_ ([[https://www.cobalstrike.com/help-malleable-c2](https://www.cobalstrike.com/help-malleable-c2)]([https://www.cobalstrike.com/help-malleable-c2](https://www.cobalstrike.com/help-malleable-c2)) accessed on 8 July 2021) as it modifies the beacon's fingerprint. This masks our network activity and  
Figure 1: ATT&CK model of the emulated threat actor.  
our malware's behavior, such as the staging process; see Listing A1 in Appendix A. Please note that it has been slightly formatted for the sake of readability.