Michael Leibowitz - EDR is Coming: Hide Yo Sh!t
Catalogs practical techniques for evading modern EDR solutions across file system, memory, process, and network visibility layers.
Summary
EDR Evasion Techniques
Michael Leibowitz (Senior Security Researcher, Nvidia) presents a comprehensive survey of techniques for evading modern Endpoint Detection and Response (EDR) solutions, covering all visibility layers from file system to network.
EDR Architecture and Visibility
Modern EDRs instrument systems through kernel minifilter drivers (file I/O), ETW (Event Tracing for Windows) providers, AMSI hooks, userland API hooks via IAT/inline patching, and network kernel callbacks. Effective evasion requires understanding and defeating each layer.
File System Evasion
Alternate Data Streams (ADS), process hollowing without disk-based staging, and reflective DLL loading avoid triggering file-based signatures. Timestomping and VSS manipulation defeat forensic artifact recovery.
Memory and Process Evasion
Direct system calls (bypassing userland hooks), Heaven's Gate (WoW64 transitions), and process doppelgänging abuse Windows transactional NTFS to create process images that exist only in transaction memory, evading both file scanning and memory scanning.
Network Evasion
Using legitimate cloud services (OneDrive, Slack, GitHub) as C2 channels, and domain fronting through major CDNs, prevents network-based EDR from distinguishing malicious from legitimate traffic.
Related talks
Main Stage·47 min
Alessandro Magnosi
Malware deployment tactic exploiting NTFS features and emulated read-only filesystems to bypass endpoint inspection.
Main Stage·43 min
A Hernando · B Martinez
Uncovers overlooked legacy Windows execution paths and registry mechanisms to establish stealthy persistence that evades modern EDR detection.
Main Stage·16 min
Scott Taylor
Scott Taylor introduces C4, an open-source framework decoupling payload implants from command-and-control protocols using versatile external connectors.