Done a small EDR evasion research lab, the name of the EDR I will not disclose, since I don't know whether…
Vitalii Bibikov — SOC Analyst, Blue team, Purple team, Incident Response, Inestigation
Done a small EDR evasion research lab, the name of the EDR I will not disclose, since I don't know whether it is a sensitive information or not, anyways, the research was driven by personal curiosity and has self educational intentions.
Objective: Learn how an EDR works, understand how to bypass different layers of detection, making a PoC to evade detection and run basic recon commands (ex. whoami, host, dir, etc...), developing detection strategies.
Description: Built a self-hosted EDR lab using VirtualBox + Docker and developed a PoC that achieved zero alerts through a layered evasion chain: direct syscalls via Hell's Gate SSN resolution, VEH-based control flow using hardware breakpoints (DR0/SetThreadContext), PPID spoofing via PS_ATTRIBUTE_PARENT_PROCESS to impersonate explorer.exe, and elimination of child process spawning in favour of in-process env var expansion. Each layer was validated against live EDR detection rules, with the final PoC bypassing both parent-child behavioural detection and binary execution signatures simultaneously.
Tools: C (MinGW/GCC), Sysmon, Docker, VirtualBox, Windows Internals (NT API), upx
3 reactions · 2 comments
Comments
Chris G.: Nicely done Vitalii. Great way to learn and a good resume item to add.
Vitalii Bibikov: Chris Gebhardt Thanks!