BlueGuard: Accelerated Host and Guest Introspection Using DPUs

EvilEDR: Repurposing EDR as an Offensive Tool

Speakers: Kotaiba Alachkar (Delft University of Technology); Dirk Gaastra (Independent Researcher); Eduardo Barbaro (Delft University of Technology); Michel van Eeten (Delft University of Technology); Yury Zhauniarovich (Delft University of Technology)

Conference: USENIX Security

Overview

Endpoint Detection and Response (EDR) systems are widely adopted in enterprises for their continuous monitoring, threat detection, and response capabilities, forming a cornerstone of modern security architectures. However, this paper introduces a novel and concerning paradigm: EDR repurposing, dubbed EvilEDR. Unlike traditional attacks that aim to evade or tamper with EDRs, EvilEDR leverages the legitimate, inherent functionalities of an EDR system itself for offensive purposes. The research demonstrates how an attacker-controlled EDR can be weaponized to execute arbitrary commands, transfer tools, exfiltrate sensitive data, and covertly collect system information, all while masquerading as a trusted security solution.

The authors, a team from Delft University of Technology and an independent researcher, highlight that EvilEDR does not exploit software vulnerabilities but rather misuses the powerful, trusted features designed for defense. This approach represents a significant shift in offensive security, proving to be more efficient and stealthier than traditional bypass techniques. The study evaluates four prominent EDR solutions—Microsoft Defender for Endpoint (MDE), Elastic Defend, Sophos EDR, and Trend Micro Apex One—showing that each can be repurposed to facilitate various stages of an attack lifecycle, including persistence, lateral movement, command and control, and data exfiltration.

The implications of EvilEDR are profound for enterprise security. Its ability to operate undetected alongside legitimate EDRs, communicate with trusted domains, and even impair existing defenses by registering its own Endpoint Protection Platform (EPP) or isolating hosts, poses a formidable challenge. Beyond identifying this threat, the paper also proposes concrete, actionable defense strategies for both enterprises and EDR vendors, aiming to raise awareness and foster the development of more resilient security measures against this innovative attack vector.

Background

The evolution of endpoint security has been a continuous race against increasingly sophisticated threats. Traditional AntiVirus (AV) solutions, relying on signature-based detection, proved inadequate against polymorphic malware and advanced evasive techniques. This led to the emergence of Next-Generation AV (NGAV), which incorporated behavioral and cloud-based analysis. As attack campaigns grew more complex and multi-staged, a single-point security approach remained insufficient. This gap was addressed by Endpoint Protection Platforms (EPP), integrating NGAV with host-based firewalls, intrusion prevention, data encryption, and device control into a unified, centrally managed system. While EPPs excel at preventing initial infections, they often lack advanced threat detection and response capabilities for post-compromise scenarios.

This deficiency spurred the development and widespread adoption of Endpoint Detection and Response (EDR) systems, designed to complement EPPs by providing real-time visibility, advanced threat detection, and rapid response across endpoints. EDR systems typically consist of two main components: software agents deployed on endpoints and a central server (self-hosted or cloud-hosted). The agents operate with deep Operating System (OS) integration, often running with SYSTEM-level privileges in both kernel and user mode. They leverage kernel-level drivers to monitor system calls, process creation, network connections, registry changes, file activities, and memory access, alongside Event Tracing for Windows (ETW) for efficient event notification. The EDR server aggregates this telemetry, applying advanced analytics and machine learning to identify threats, manage fleets of endpoints, and provide tools for investigation and remediation.

A critical aspect of EDR systems is their trusted status. This trust is derived from their role as security solutions, the reputation of their vendors, and rigorous technical validations. EDR drivers undergo strict certification processes, such as Microsoft's kernel-level access requirements, and their software and processes are digitally signed. These measures ensure authenticity, tamper resistance, and privileged operation, making EDR systems deeply integrated and reliable components within enterprise environments.

Prior research in EDR security has largely focused on EDR evasion (techniques to bypass detection) and EDR tampering (disabling or modifying EDR protection mechanisms), often by exploiting software vulnerabilities. Examples include work by SafeBreach Labs exploring anti-tampering bypasses in Palo Alto Networks Cortex EDR. Other related areas include Living-Off-The-Land (LotL) techniques, which repurpose pre-existing benign OS tools for malicious ends (e.g., LOLBAS Project, LOLDrivers Project), and the weaponization of legitimate tools like Remote Monitoring and Management (RMM) software. The EvilEDR concept, however, distinguishes itself by not relying on vulnerabilities or pre-existing OS tools. Instead, it involves installing an attacker-controlled EDR solution and misusing its inherent, legitimate functionalities and trusted status. This represents a novel approach to offensive security, leveraging the EDR's own strengths against the defender.

Key Findings

The core finding of this research is the introduction and demonstration of EvilEDR, a novel attack concept where legitimate EDR systems are repurposed as powerful offensive tools without exploiting software vulnerabilities. The study makes several key contributions:

• First Study of EDR Repurposing: To the best of the authors' knowledge, this paper presents the inaugural study on intentionally using EDR systems for offensive purposes, moving beyond evasion and tampering.
• Comprehensive Attack Capabilities: EvilEDR can be effectively used across multiple attack stages, including:
• Command and Control (C2): Executing arbitrary commands via the live response console.
• Tool Transfer: Uploading and downloading tools and files, often bypassing Mark of the Web (MotW).
• Data Exfiltration: Retrieving sensitive information and system files.
• Information Gathering: Passively collecting system and account telemetry to facilitate further exploitation and lateral movement.
• Persistence: Leveraging the EDR agent's inherent persistence and tamper protection.
• Privilege Escalation: Executing commands with SYSTEM-level privileges.
• Defense Impairment: EvilEDR can actively degrade enterprise defenses by:
• EPP Takeover: Registering its own deliberately weakened Endpoint Protection Platform (EPP) as the default, effectively neutralizing existing EPPs.
• Host Isolation: Severing the Enterprise EDR's telemetry and response channels by isolating the host to communicate only with the EvilEDR server.
• Covert Operation: EvilEDR agents operate covertly, masquerading as legitimate processes. In cloud-hosted setups, they communicate with trusted vendor domains, making network traffic appear benign and significantly harder to detect by traditional network monitoring.
• Evaluated Effectiveness: The research evaluated EvilEDR's effectiveness against four leading EDR solutions—Microsoft Defender for Endpoint (MDE), Elastic Defend, Sophos EDR, and Trend Micro Apex One—within a simulated secure enterprise environment. The findings consistently showed that EvilEDR operations often remained undetected by the Enterprise EDRs, highlighting its significant impact in practical scenarios.
• Actionable Defense Strategies: The paper proposes a multi-layered approach for detecting and mitigating EvilEDR at both enterprise and vendor levels, providing practical implementations for detection measures (e.g., Sigma rules for driver loads and processes).

In essence, the study reveals that the very attributes that make EDR systems indispensable for defense—deep OS integration, trusted status, extensive monitoring, and remote response capabilities—can be weaponized, turning them into a "double-edged sword" for attackers.

Technical Deep Dive

The concept of EvilEDR leverages the rich functionalities of modern EDR systems, which are designed to launch processes, run custom commands, and transfer files. Attackers deploy EvilEDR agents on target endpoints and control them through their own EvilEDR server, effectively turning a defensive tool into a sophisticated C2 framework. This approach is simple because it bypasses the need for complex exploits or custom tools, relying instead on off-the-shelf EDR features. It is effective due to the trusted status of EDR binaries (code-signed with valid certificates), their deep OS-level access, and the ability to operate alongside Enterprise EDRs without detection.

The paper meticulously maps EvilEDR's capabilities to the MITRE ATT&CK Matrix for Enterprise, demonstrating its potential across various attack stages:

1. Initial Access (T1566 - Phishing, T1190 - Exploit Public-Facing Application): While EvilEDR requires elevated privileges for installation, its trusted status and signed binaries can facilitate initial access attempts involving phishing. The download and installation process for EvilEDR agents can bypass enterprise prevention controls that would flag typical malicious installers, reducing detection risk.
2. Execution (T1059 - Command and Scripting Interpreter): EvilEDR enables attackers to execute scripts or binaries, either manually via the live response console or automatically through configured response actions. It supports native scripting languages like PowerShell. For example, MDE and Elastic Defend supported running scripts from uploaded files or the EDR server's library. While known malicious tools (e.g., mavinject.exe for DLL injection) might still trigger alerts from the Enterprise EPP/EDR, custom scripts, such as a ransomware simulation, were successfully executed and remained undetected in tests.
3. Persistence (T1547 - Boot or Logon Autostart Execution): EDR agents are inherently persistent, designed to remain active across reboots and updates, and are protected by self-defense mechanisms. EvilEDR leverages this built-in persistence to maintain control over the target system. All tested EDR solutions demonstrated persistent activity without being flagged as malicious by Enterprise EDRs.
4. Privilege Escalation (T1078 - Valid Accounts, T1548 - Abuse Elevation Control Mechanism): EDR agents typically operate with SYSTEM-level privileges. The EvilEDR live response console allows attackers to execute commands with these highest privileges, eliminating the need for external tools like PsExec that might trigger alerts. All tested EDR live response consoles ran as NT AUTHORITY\SYSTEM.
5. Defense Evasion (T1562 - Impair Defenses): This is a critical area where EvilEDR significantly impacts security.

• EPP Takeover (T1562.001 - Disable or Modify Tools): EDR vendors often bundle EPP capabilities. EvilEDR can exploit this by registering its own EPP as the system's default, overwriting or replacing the existing EPP. This is achieved through legitimate EDR functionality (e.g., Elastic, Sophos, Trend Micro). Once registered, the attacker can disable protection features or switch to audit mode, effectively neutralizing the EPP without user-facing notifications or alerts from the Enterprise EDR.
• Host Isolation (T1562.004 - Indicator Blocking): A key EDR feature, host isolation, limits a compromised host's communication to only the EDR server. Attackers repurpose this to isolate the target host, ensuring it communicates solely with the EvilEDR server. This prevents the Enterprise EDR agent from sending telemetry logs or performing remote response actions, making the host appear offline to the legitimate EDR. All tested EDR solutions offered this feature, and its use was not flagged as malicious.

1. Credential Access (T1003 - OS Credential Dumping): EvilEDR can extract sensitive credential information. Specifically, MDE, when used as EvilEDR, was uniquely capable of bypassing OS protections to extract Security Account Manager (SAM) and SYSTEM registry hive files, which contain critical local and domain account information. This extraction process went undetected by Enterprise EDRs, whereas control tests using PsExec were blocked.
2. Discovery (T1082 - System Discovery, T1087 - Account Discovery): EvilEDR's built-in telemetry and continuous monitoring provide attackers with passive, in-depth visibility into compromised systems and their environments without triggering detections. This includes tracking user behavior, system processes, network traffic, and enumerating local and domain accounts. While active enumeration with tools like SharpHound would likely trigger alerts, EvilEDR's passive collection remains stealthy, though it may lack the depth of active tooling.
3. Lateral Movement (T1570 - Lateral Tool Transfer): EvilEDR allows the upload of arbitrary files, facilitating the transfer of additional tools between compromised devices. Crucially, files uploaded via EvilEDR bypass the Mark of the Web (MotW), which typically flags Internet-downloaded files and blocks macros. MDE and Elastic provided robust upload features. While known malicious artifacts might still be detected upon execution, the upload itself often goes undetected.
4. Collection (T1005 - Data from Local System, T1119 - Automated Collection): EvilEDR enables active data collection from the local system, manually via the live response console (accessing files, processes, system info) or through built-in investigation package collection. It also supports automated collection mechanisms via scheduled tasks, event triggers, or APIs, ensuring up-to-date snapshots of target systems for large-scale campaigns. All tested EDRs provided these collection capabilities.
5. Command and Control (T1071 - Application Layer Protocol): The remote command execution feature in the EvilEDR live response console serves as a robust C2 channel. Attackers can remotely execute commands, exfiltrate files, and upload/run files with SYSTEM privileges. All tested EDRs provided this capability, and actions were executed without triggering Enterprise EDR alerts. EvilEDR's live response traffic is encrypted (typically HTTPS). In cloud-hosted setups, this traffic routes to legitimate vendor domains, making it appear benign. Self-hosted setups, however, communicate with attacker-controlled IPs/domains, which are more prone to detection.
6. Exfiltration (T1041 - Exfiltration Over C2 Channel): EvilEDR's file download functionality via the live response console enables exfiltration of valuable files (documents, system files, browser cookies). The built-in "get file" command encrypts files on the host and provides them as downloads through the attacker's browser. MDE, Elastic, and Trend Micro provided this functionality, and exfiltration attempts went undetected by Enterprise EDRs.
7. Impact (T1490 - Inhibit System Recovery): EvilEDR's persistence and SYSTEM-level privileges allow attackers to manipulate, interrupt, or destroy target systems and data. A standout technique is inhibiting system recovery. EvilEDR's tamper protection prevents its unauthorized removal, even if detected. This makes system recovery extremely complex, often necessitating OS clean installations. Attackers can also overwrite critical system data (e.g., logs, registry hives) to disrupt forensic investigations.

The choice between cloud-hosted and self-hosted EvilEDR depends on the desired stealth. Cloud-hosted solutions offer higher stealth due to communication with legitimate vendor domains, but vendors could revoke access. Self-hosted solutions communicate with attacker-controlled IPs, making detection easier. EvilEDR configuration typically involves switching security policies to audit mode or disabling them and minimizing cloud/telemetry submissions to the EDR vendor to reduce detection risk.

Demo / Proof of Concept

The feasibility and effectiveness of EvilEDR were rigorously evaluated through a case study resembling real-world attack scenarios, specifically leveraging the MITRE Engenuity ATT&CK Evaluations Turla (2023). This evaluation assessed 29 EDR solutions against the tactics, techniques, and procedures (TTPs) of the Turla APT group. The authors used a testbed replicating a typical secure enterprise environment, comprising Windows 11 endpoints (version 22H2) and a Windows Server 2022 domain controller. Each endpoint was protected by Windows Defender EPP (in block mode) and an Enterprise EDR. The four EDR solutions under study (MDE, Elastic, Sophos, Trend Micro) were interchangeably used as both Enterprise EDR and EvilEDR, ensuring all pairwise combinations were tested.

The evaluation compared the detection rates of Enterprise EDRs against Turla's baseline TTPs with those executed using EvilEDR. When configured as EvilEDR, cloud submission features were disabled, and security features were set to audit mode or turned off to maximize stealth.

Key results from the Turla (2023) scenarios (Carbon and Snake) demonstrated EvilEDR's stealth and effectiveness:

• Initial Compromise & Establish Initial Access: In the baseline, spearphishing leading to backdoor installation was detected by all four Enterprise EDRs. In contrast, the download and installation of all EvilEDR agents remained undetected by Enterprise EDRs due to their trusted status and signed binaries, proving EvilEDR as a feasible and effective alternative for establishing initial access (assuming local admin rights).
• Discovery and Privilege Escalation: Baseline techniques (e.g., exploiting weak registry permissions) were detected by all Enterprise EDRs. EvilEDR, however, could passively enumerate workstations and obtain similar information (including domain accounts) through its built-in telemetry without detection. Furthermore, EvilEDR inherently operates with SYSTEM privileges via its live response console, eliminating the need for exploits, and its regular operation was not detected.
• Persistence: The baseline's installation of second-stage malware for persistence was detected by all Enterprise EDRs. EvilEDR agents, by design, maintain persistence through reboots and updates. While Enterprise EDRs recorded telemetry of EvilEDR's persistence mechanisms (e.g., service creation), they did not flag these activities as malicious, demonstrating EvilEDR's highly effective persistence.
• Lateral Movement & Credential Access: Baseline lateral movement (password spraying, Mimikatz, PsExec) and keylogger use were largely detected. Notably, MDE as EvilEDR could bypass OS protections to export SYSTEM, SAM, and SECURITY registry hives to obtain NTLM hashes, and this activity was not detected by any Enterprise EDR. Other EvilEDRs could indirectly assist via command execution, but active malicious commands through the response console often led to detection, similar to the baseline. For exfiltrating emails, MDE, Elastic, and Trend Micro EvilEDRs successfully used their built-in get-file features, and these activities were not detected by any Enterprise EDR, making them highly effective.
• Defense Impairment (EPP Takeover & Host Isolation): While not directly part of the Turla evaluation, the paper highlighted that EvilEDR successfully registered itself as the default EPP in most cases, taking over Windows Defender EPP protections without triggering detection or alerts. Similarly, isolating hosts using EvilEDR caused the Enterprise EDR server to show the host as offline, with no logs received and no malicious flagging.

The evaluation demonstrated that EvilEDR, leveraging its trusted status and inherent capabilities, can perform a wide range of attack techniques with a significantly reduced risk of detection compared to traditional malicious tools, especially when utilizing cloud-hosted solutions that communicate with legitimate vendor domains.

Defensive Implications

Defending against EvilEDR requires a multi-layered approach at both the enterprise and vendor levels, moving beyond the traditional focus on EDR evasion and tampering. The guiding principle for enterprises should be to consider every EDR as a potential EvilEDR unless explicitly authorized and managed.

Enterprise-Level Defenses

1. Prevention: These controls aim to hinder EvilEDR deployment and execution, particularly post-initial access.

• Principle of Least Privilege: Strictly enforce that standard users do not have local administrative rights. Administrative privileges should be assigned to non-personal accounts managed through Privileged Access Management (PAM) solutions. Since EvilEDR requires elevated privileges for installation, this significantly raises the bar for attackers.
• Strict Software Installation Policies: Implement Windows Defender Application Control (WDAC) or Software Restriction Policies (SRPs) via Group Policy. These enforce strict allowlists, permitting only vetted and authorized applications to be installed or executed, even if they appear legitimate and are digitally signed like EDR agents.
• Restrictive Network Policies: Apply strict outbound network controls, especially on critical endpoints, allowing communication only with approved domains and IP addresses. Network security solutions (e.g., proxies) should monitor and block suspicious connections to external EDR domains not utilized by the organization, especially important for self-hosted EvilEDR setups.

2. Detection: These measures focus on identifying the presence and activity of unauthorized EDRs. EDR solutions operate with unique drivers and processes, which are protected by tamper protection and digital signing. These characteristics facilitate rule-based detection. The authors provide detection rules in Sigma format for broad applicability, which can be translated into tool-specific rules for EDRs or Security Information and Event Management (SIEM) solutions (e.g., Kusto Query Language (KQL) for MDE, Elastic Query Language (EQL) for Elastic, SQL-based queries for Sophos, custom filters for Trend Micro).

• EDR Driver Load Events: Monitor Sysmon Event ID 6 (driver load events). EDR solutions install unique drivers, typically in the system's driver directory. Detection rules can identify all EDR drivers while excluding those explicitly authorized by the enterprise, providing a high-confidence signal for unauthorized EDR activity.
• EDR Processes: Detect EDR processes based on their names, which are typically fixed by vendors. While full paths or hash values can be unreliable (due to installation variations or updates), process names offer a balance of accuracy and maintainability. Security teams must tailor these rules to exclude legitimate EDR processes deployed in their environment.
• Manual Investigation: In environments lacking central log sources or where logs might be cleared, security teams can manually check for EvilEDR using PowerShell scripts. These scripts can detect EDR driver files and running EDR processes, and can be centrally executed via endpoint management tools like Intune.

Vendor-Level Measures

EDR vendors also have a crucial role in mitigating EvilEDR, though this presents significant challenges as EDR repurposing is not a software vulnerability.

• Built-in Notifications for Conflicting EDRs: EDR vendors could incorporate mechanisms that detect the installation of another EDR solution and automatically block it by default, alerting the enterprise security team. This shifts responsibility to vendors to maintain an accurate list of known EDR solutions. However, this may require substantial architectural changes and vendor collaboration.
• Stricter Access to Solutions: Vendors can implement more stringent processes for granting access or trial licenses, such as background checks or manual verifications. While this can limit access for threat actors, it also risks hindering legitimate research and broad availability.

Ultimately, effective defense against EvilEDR requires continuous monitoring, strict policy enforcement, and a proactive approach to identifying unauthorized software, even if it appears legitimate and trusted.

Key Takeaways

• EDR Repurposing is a Novel Threat: EvilEDR represents a paradigm shift in offensive security, where legitimate EDR systems are misused for malicious purposes, rather than being evaded or tampered with.
• Leverages Trusted Status and Deep OS Access: EvilEDR's effectiveness stems from its trusted status (signed binaries, legitimate vendor domains), deep OS integration (SYSTEM-level privileges, kernel access), and built-in functionalities designed for defense.
• Bypasses Traditional Detections: Cloud-hosted EvilEDR traffic communicates with legitimate vendor domains, making it appear benign and difficult for network monitoring to distinguish from legitimate EDR activity. Its installation often bypasses initial access detections due to trusted status.
• Comprehensive Attack Capabilities: EvilEDR can facilitate various attack stages, including command execution, tool transfer (bypassing MotW), data exfiltration, passive reconnaissance, persistence, and privilege escalation, often undetected.
• Actively Impairs Enterprise Defenses: EvilEDR can neutralize existing EPPs by registering its own as default and sever Enterprise EDR telemetry through host isolation, effectively blinding defenders to ongoing malicious activity.
• Multi-Layered Defense is Crucial: Effective mitigation requires a combination of strict preventive controls (least privilege, application control, network segmentation) and robust detective measures (monitoring EDR driver loads and processes, leveraging Sigma rules, manual checks) at the enterprise level, alongside potential vendor-side architectural changes.

About the Speaker(s)

The research was conducted by a collaborative team:

• Kotaiba Alachkar (Delft University of Technology)
• Dirk Gaastra (Independent Researcher)
• Eduardo Barbaro (Delft University of Technology)
• Michel van Eeten (Delft University of Technology)
• Yury Zhauniarovich (Delft University of Technology)

Their work at Delft University of Technology and as an independent researcher focuses on system security, threat detection, exploitation, and adaptive defenses, contributing significantly to understanding novel attack techniques and developing countermeasures.