You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<metaproperty="twitter:title" content="Adding Endpoint Detection to our Cyber Range">
30
30
<metaproperty="twitter:description" content="As a security analyst, you will likely come in contact with Antivirus, SIEMs, EDR, XDR and Cloud products.">
<p>As a security analyst, you will likely come in contact with Antivirus, SIEMs, EDR, XDR and Cloud products. To better understand these products it is beneficial to create your own detection lab. In this post, I will go over the practical steps to improve my current lab setup to add Microsoft Defender for Endpoint as our EDR solution.</p>
192
197
<doc-anchor-targetid="setting-up-mde">
193
198
<h2>
@@ -256,7 +261,7 @@ <h2>
256
261
<span>Testing Detection Capabilities</span>
257
262
</h2>
258
263
</doc-anchor-target>
259
-
<p>For the attack scenario, my lab includes a MSSQL Server. Suppose for this scenario, we gained access to the database as the <codev-pre>sa</code>user. Let's execute a simple command with the <codev-pre>xp_cmdshell</code> stored procedure.</p>
264
+
<p>To test our new EDR, let's assume we've gained <codev-pre>sa</code>access to a MSSQL server. Let's execute a simple command with the <codev-pre>xp_cmdshell</code> stored procedure.</p>
<p>At this point, nothing is particularly suspicious. We’re technically just using built-in MSSQL functionality. So MDE has not created any alerts just yet. Let's step it up a notch and try to run a few more commands.</p>
276
+
<p>At this point, nothing is particularly suspicious. We’re technically just using built-in MSSQL functionality, and since <codev-pre>xp_cmdshell</code> is a legitimate feature, it doesn't always trigger an immediate "High" severity alert. Let's step it up a notch and try to run a few more commands.</p>
272
277
<p>Since we’re running as a service account, we often inherit <em>spicy</em> local privileges that pair very nicely with classic Potato attacks. So naturally, the next logical move is to try uploading a Netcat binary to the target, because subtlety is overrated.</p>
<p>As expected, this attempt gets <strong>immediately nuked</strong> by MDE. The binary is signatured, Defender clocked it instantly, and the dream is over before it even started.</p>
283
+
<p>As expected, this attempt gets <strong>immediately nuked</strong> by MDE. The binary is signatured, Defender clocked it instantly, and the dream is over before it even started. The file was deleted before it could even be executed.</p>
<p>This PowerShell cradle is a small adaptation to one of the public cradles on <ahref="https://github.com/swisskyrepo/PayloadsAllTheThings">PayloadAllTheThings</a> to avoid signature detections.</p>
303
+
<p>This PowerShell cradle is a small adaptation to one of the public cradles on <ahref="https://github.com/swisskyrepo/PayloadsAllTheThings">PayloadAllTheThings</a> to avoid basic AMSI triggers.</p>
299
304
</div>
300
305
</div>
301
306
</div>
@@ -319,6 +324,7 @@ <h2>
319
324
<figcaptionclass="caption"></figcaption>
320
325
</figure>
321
326
</p>
327
+
<p>We can see the exact Base64 command line, the network connection to the attacker IP, and the subsequent commands run inside the shell.</p>
<p>Microsoft Defender for Endpoint is undeniably a strong security product. As demonstrated, it is highly effective at detecting and outright blocking known threats, particularly those that rely on well-known tooling, static signatures and behavioral analysis. However, as this lab also shows, detection does not always equate to prevention. When attackers adapt their techniques and move toward custom or living-off-the-land approaches, MDE may allow execution while still generating telemetry and alerts.</p>
329
335
<p>This highlights an important takeaway: MDE is not a silver bullet. With sufficient adaptation, creativity, and an understanding of how detections work, it is entirely possible to bypass certain protections. That does not make MDE ineffective, it simply reinforces the reality that endpoint security is an ongoing cat-and-mouse game rather than a solved problem.</p>
330
-
<p>In a future post, I will take this a step further and explore how Microsoft Defender for Endpoint can be bypassed using a custom Sliver stager, focusing on evasion techniques and the resulting detection artifacts.</p>
336
+
<p>In the <strong>next post</strong>, we’re going deeper. I’ll demonstrate how to bypass MDE’s behavioral engines using a <strong>custom Sliver stager</strong> and analyze the resulting artifacts in the Advanced Hunting console. Stay tuned!</p>
<divclass="line-clamp-3"><pclass="hidden mt-2 md:block">As a security analyst, you will likely come in contact with Antivirus, SIEMs, EDR, XDR and Cloud products.</p></div>
0 commit comments