Cyber101: What is EDR Evasion?

A reader recently asked “How can an attacker evade EDR? I thought that the whole point of EDR was that it could stop threats?”  That’s valid, and deserves explanation, so let’s dive in.

First things first, Endpoint Detection and Response (a.k.a. Advanced anti-malware) is a tool-set that is vital to the overall security posture of an organization.  Just because it isn’t perfect, doesn’t mean you don’t need it.  Quite the opposite: you absolutely need anti-malware solutions to stop about 90% of the different types of threats that impact desktops, laptops, and servers. 

However, as was just noted, they’re not perfect.  There are attacks that can evade detection by an EDR - at least for long enough to cause damage before they are stopped. Threat actors are (mostly) driven by profit, so when an EDR makes their lives difficult, they find ways around the EDR to continue making money from victims. There are several ways that this goal of EDR evasion can be accomplished, including the most common techniques:

Using legitimate tools

While EDR systems are great at detecting unknown or unusual executable code attempting to run on an endpoint, they have trouble with detecting if a legitimate tool is being misused or abused to make mischief. Common examples of this in today’s threat landscape include using remote-administration tools (AnyDesk, Remote Desktop, etc.) that are used by IT teams, and compromising real applications (supply-chain attacks).  Because these tools are recognized as legitimate, and because many of them are explicitly excluded from being shut down by the EDR, threat actors know that using these tools to perform attacks greatly increases the chances that they’ll evade the EDR. 

Weaponising the Operating System (OS)

In every OS, there are literally thousands of components, tools, and functions.  Most of these can’t successfully compromise the system itself, but can be used to help a threat actor perform tasks which do compromise things. Living off the Land (LOL) attacks take advantage of this by twisting the purpose of very real components of an OS in order to gain more privileges, access more of the system, and also to evade detection by an EDR.  This is because the EDR can’t effectively just shut down parts of the OS itself without risking crashing the system and/or creating business outages. While there is still a good chance the threat actor will get caught when they continue their attack, leveraging the OS itself can allow them to avoid detection for quite a long time. 

Quickly exploiting new vulnerabilities combined with social engineering

Not every attack that leverages the OS is Living off the Land.  In many cases, a threat actor who can move quickly enough can take advantage of a flaw in the OS or major software to subvert that code to their own purposes. This is different from the above because the threat actor is specifically not using the tools or OS themselves, but rather using a flaw in these software platforms to achieve a different goal altogether. For example, they’re not attacking by using a legitimate tool to gain remote access, and they’re not Living off the Land, but instead are just tricking a vulnerable piece of software into doing something it should not be able to do, then moving on. Since the EDR may not yet know about the vulnerability, it also doesn’t yet know to block an attacker exploiting that vulnerability. 

There are, of course, many more ways to evade an EDR. Each method or technique has different levels of difficulty, and requires different levels of skill on the part of the attacker, but they end up serving the same goal - the EDR does not block the attacker. 

What to do about this problem

EDR evasion is a real and pervasive issue in cybersecurity, so how do organizations deal with it and head off the threat actors before they succeed? There are two key components to security posture that are necessary to make that happen:

First, no organization should rely on any one, single security control to work without ever failing.  Every security tool can fail, and by nature they will fail in some unanticipated way.  Multi-layered security posture is key to making sure that no one control failure will lead directly to a compromise.  For example, leveraging network security along with an EDR helps to compensate for EDR failure by restricting how an attacker can move if they do evade the EDR. Data Security Posture Management (DSPM) can restrict the ability of an attacker to access and steal data if they overcome the EDR to gain access to a system that holds that data. 

Second, monitoring all security telemetry can allow an organization to spot EDR evasion quickly and shut down the attack before it can succeed. Pondurance MDR, for example, routinely sees the signs of EDR evasion and isolates user accounts and/or devices to stop a threat actor from being able to continue their attack using them. If the EDR was the only monitored security control, evasion would be invisible since the EDR itself wouldn’t report what it believes to be legitimate activity. Seeing telemetry data from the network defenses, other endpoint defenses (like RansomSnares), etc. allows the MDR system to recognize that there is threat activity happening; even when the EDR thinks nothing is going wrong. 

EDR evasion is a real phenomenon, even though an EDR is a critical and necessary piece of technology. There are multiple ways and techniques EDR evasion can be used to allow an attacker to be successful in their attack even when a properly configured EDR is in place and working.  Layered security - and monitoring those security controls as an overall system - means that just because the EDR can be evaded, the attacker won’t automatically succeed in their goals.

About the Author: Michael DeNapoli is a seasoned Senior Solutions Architect with more than 25 years of experience in cybersecurity, solution architecture, and enterprise systems design. Throughout his career, he has led technical strategy, security architecture, and advanced solution development for organizations ranging from emerging security vendors to global enterprises. Michael’s expertise spans cybersecurity operations, cloud architecture, technical sales leadership, security posture management, and identity protection, with a proven track record of guiding clients through complex technology challenges. Today, he brings his deep industry knowledge to Pondurance as a Senior Solutions Architect, helping organizations strengthen their security foundations with clarity and confidence.