Understanding XDR Detection Methods

Question

I'm interested in security and redteaming in particular, and as I'm learning about the subject I'm trying to find out what kind of things a blue team EDR/XDR solution will look for as part of its behavioral analysis/zero day detection/insert marketing term here.

So I can figure out how to better operate against such systems as an attacker trying to evade them would. Obviously there is a great deal of secrecy in terms of the nitty gritty details of how such systems determine a certain pattern of behavior is suspicious, both to prevent other vendors from copying techniques and to make it harder for actual attackers to figure out how to evade them.

Is there any general overview of what most EDR/XDR solutions consider "suspicious?" I understand the obvious patterns -- for example, an unknown process opening a handle to explorer.exe / chrome.exe, a process overwriting executable files, processes running out of weird directories, potentially in particularly locked down systems any unsigned image being run at all, etc. And I suppose as I practice at it over time I will figure out more through trial and error. But is there any resource to provide information on what kind of things these solutions are looking for besides that?

I figure if I want to be effective at redteaming I'd want to act as an attacker actually would so I can provide a realistic assessment of how well the blue team's security works, and running around setting off the EDR/XDR blatantly obvious attacks then just saying "yup looks like your security is good" because their security solution managed to detect a Metasploit module calling WriteProcessMemory against Explorer isn't the most effective way to actually assess someone's security against an actually competent attacker.

Obviously security vendors aren't going to just give out point by point explainers on how their software works specifically under the hood, but I figured it would be good to understand how it works as much as possible to more accurately assess its effectiveness.

Answer 1

Tough to answer, since there is much to explain. Keep in mind this answer is very non-technical and only tries to give you some pointers. Also, I'm not a professional red teamer.

EDR vs. XDR
First of all, EDR is a component of XDR. Even thought, you can find definition for EDR from Gartner for example, there's not really a definition telling what an EDR does exactly technically. XDR is so much different from EDR and an even newer concept (so even more open to interpretation). XDR is a lot of things, and there can be "open" XDR (multiple third party solutions) and "closed" XDR (one provider) like Palo Alto Cortex.

Bypassing XDR
So obviously, for XDR, there is no one-size-fits-all bypass solution. You will have to find out what are the solutions deployed in the environnement you wish to compromise first.

Bypassing EDR
Less obviously, there is no one-size-fits-all solution for EDR. Although, you can easily find documentation and repositories of ideas, concepts and solutions about EDR evasion. Usually, they involve exploiting weaknesses in the operating system, in which the EDR is embedded and not a vulnerability in the EDR itself per se.

So if you want to evade EDR, your best shot is to learn about how an EDR solution pulls events and telemetry from the system away first. Which, of course, means you have low-level knowledge about how the targeted operating system works and how to hack it.

As you know, the D in EDR is for Detection. EDR is not an EPP (Endpoint Protection Platform), it does not prevent compromise, it tries to detect threats that have already compromised the endpoint. Then, it offers a bunch of response capabilities.

There are some static tools for detection, such as engines (for IoC, YARA or SIGMA for example) that work with pre-defined rules (actually there's hundreds, thousands of them). But this is kind of the same approach as with EPP signatures of known malwares. The main difference in approach is the use of Machine Learning (ML). User and Entity Behavior Analytics (UEBA) are a real concepts (not only a marketing one). An EDR solution cannot be operational on day 1 after its deployment. It needs to learn from the endpoints first. Once it knows how endpoints are supposed to behave, then it can detect divergence in behavior. It does analysis from the endpoint level and the console level.

So, you want to go undetected, you must start to learn how to behave. As always, good recon is the basis for a successful achievement of the set goals. The more you know about your target, the more you will be able to blend in.

For last, I would emphasize on the fact that a EDR must be operated by a SOC. Minor incidents are not treated like major incidents. So even if the EDR detected you, if it is minor, you might have half up to a full day to operate. Even though SOCs nowadays rely more and more on automation and ML, it cannot respond to every incident in real-time.

A group like Lapsus$ (https://attack.mitre.org/groups/G1004/) showed that you didn't need strong technical skills to steal data from big corporations. They mainly relied on social engineering and fraud to breach the perimeter. Once they were in, they didn't really care about being stealthy or establishing good persistence. They often took the short way to achieve their objectives and took whatever they could before being blocked, when they triggered all the alarms. So, instead of bypassing detection, you might try to bypass the response.

I hope this gives you some ideas about how to bypass EDR solutions. Keep in mind ML is though a beast to beat.