EDR Evasion

When to Activate

• Planning EDR bypass during red team engagements
• Researching AV/EDR evasion techniques
• Developing implants that must survive endpoint detection
• Testing detection capabilities of security products

Fundamentals

AV vs EDR

Antivirus (preventive):

• Static analysis: matching known signatures in files
• Dynamic analysis: limited behavioral monitoring/sandboxing
• Effective against known threats, weaker against advanced attacks