Will It Run? Fooling EDRs with command lines using empirical data

Many intrusions now rely on built-in Windows tools and other trusted executables instead of dropped malware, so defenders increasingly judge intent from the command line. That makes command-line obfuscation attractive: the text changes while the program still runs as intended. The talk starts with simple cases, such as swapping look-alike Unicode dashes past a vendor rule for an encoded PowerShell command, or using unusual slashes and stray characters with a download utility to get past a URL-based rule.

To go beyond one-off tricks, the speaker black-box fuzzed 68 commonly abused Windows binaries and recorded which transformations each one accepted. These included case changes, character substitutions and insertions, dropped trailing characters, alternate path and URL notation, and extra quote marks. Each executable got a JSON model describing its quirks, and a PowerShell module used those models to generate combined obfuscations, which were then checked against real output. Quote insertion worked on about 93 percent of the binaries, and character substitution on about 72 percent.

For defenders, the advice is to stop relying on argument strings alone and to build detections around underlying behaviour in process, file and network events, which are harder to fool. Simple checks, such as unusual quote counts or unexpected Unicode ranges, can also catch many variants. The speaker expects the problem to persist because Windows must stay backward compatible, and notes that macOS and Linux have their own argument quirks, with further research to follow.