A sophisticated attack technique has been uncovered in which hackers exploit free Endpoint Detection and Response (EDR) to disable existing security measures on already compromised systems.
See also: Hackers gain initial access to organizations with RMM tools
This method, called BYOEDR (Bring Your Own EDR), is a worrying development in evasion techniques, as it relies on the misuse of legitimate security tools to undermine the very systems they are designed to protect.
The technique was first identified by researchers Mike Manrod and Ezra Woods, who found that attackers can obtain trial versions of EDR products and use them to neutralize other security software already installed on targeted systems.
In their experiments, they showed that Cisco Secure Endpoint (AMP) could be installed and configured in a way that disabled CrowdStrike Falcon and Elastic Defend, without triggering any alarms or producing any telemetry, beyond losing communication with the system.
See also: Microsoft: Russian hackers breach embassies via ISPs
According to Mike Manrod and Ezra Woods, the technical process involves several critical steps that exploit the administrative capabilities of EDRs. After gaining local administrator, attackers sign up for free EDR trials, download the agent installer, and install it on the targeted system.
Then, they go to the Management > Policies of the EDR console, open the “Protect” for Windows, and systematically remove all exclusions from the Exclusions.
The final step involves identifying the SHA256 hash of the target EDR process and adding it to the “Blocked Application List” via the Outbreak Control > Blocked Application.
What makes the technique particularly dangerous is its ability to bypass tamper protection, which typically prevent unauthorized changes to security software.
See also: Hackers target Python developers via fake PyPI site
Unlike more complex detection evasion methods, such as BYOVD (Bring Your Own Vulnerable Driver) or DLL-unhooking techniques, BYOEDR offers a simpler but equally effective approach.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
