A Red Team Exercise, 15 Years Later

The talk examines how endpoint detection and response (EDR) products are evaded on Windows. The speaker, a penetration tester and red teamer, contrasts EDR's weighted, telemetry-based scoring with signature-driven antivirus, which he argues cannot keep up with modern attackers. He then explains how scripting engines pass content to the Antimalware Scanning Interface and where kernel-side monitoring sits beneath the Win32 call chain.

The middle of the talk covers bypass techniques: inline patching of AMSI and ETW functions, hardware breakpoint hooking, and provider hijacking against ETW, which the speaker notes is difficult to disable without kernel access. DLL unhooking swaps the hooked copy of a library in memory for a clean one fetched from Microsoft's symbol server, matched by timestamp and image size. The demonstrated chain pairs a PowerShell-hosted .NET downloader with position-independent shellcode that resolves functions by hashed names, then process hollows svchost.exe to run the payload.

The closing points are that effectiveness varies between products and depends on configuration. In the Q&A, the speaker said correctly configured kernel-level telemetry should flag changes to memory protections, while parent process ID spoofing might make an EDR treat a new process as coming from another parent. For defenders, the practical lesson is to confirm that EDR consumes kernel-level events and watches memory permission changes, and to test detections against custom tooling rather than well-known public tools.