How Attackers Evade Modern EDR

What does "Ghosts in the Endpoint" mean exactly, to what Mat was referencing to? The "Ghosts in the Endpoint" metaphor is a very clever title, and it captures a very real and troubling reality: many attacks are now invisible to endpoint security tools.

Here are the main techniques adversaries are employing to defeat, and bypass, such detection:

Living-Off-the-Land (LOLBins) — Hiding in Plain Sight

• Rather than deploying obvious malware, attackers abuse legitimate system tools built into Windows — like PowerShell, rundll32.exe, WMI, CertUtil.exe, and others — to download payloads, execute scripts, or perform administrative tasks.  Because these are "trusted" binaries, EDRs often treat them as benign.
• In Short: Attackers don't bring their own noisy, suspicious files.  They borrow your system's own tools.

Code Injection, Process Hollowing, DLL Injection &  Process Doppelganging

• Rather than deploying obvious malware, attackers abuse legitimate system tools built into Windows — like PowerShell, rundll32.exe, WMI, CertUtil.exe, and others — to download payloads, execute scripts, or perform administrative tasks.  Because these are "trusted" binaries, EDRs often treat them as benign.
• In Short: Attackers don't bring their own noisy, suspicious files.  They borrow your system's own tools.

Fileless & In-Memory Payloads, Obfuscation & Encryption

• Modern attacks increasingly avoid writing anything to disk.  Instead, malicious code is loaded directly into memory — often encrypted or obfuscated — to evade both file-based scanners and static signature detection.

User-Mode Hook Bypass & Direct (or Indirect) Syscalls

• Many EDRs rely on hooking Windows API functions — intercepting calls to watch for suspicious behavior.  But attackers have deployed methods to bypass those hooks:
• Unhooking: Overwriting hook modifications so the API calls go through "clean."
• Direct syscalls / indirect syscalls: Instead of using hooked functions, malware may jump straight to the kernel via syscall, bypassing the EDR's watch entirely.
• These techniques let malware perform dangerous operations — like allocating memory, spawning processes, or modifying files — without triggering traditional EDR alarms.

EDR Tampering, Driver Exploits, and "Killing the Lights"

• Perhaps the most alarming tactic: attackers sometimes disable or manipulate the EDR itself.  Given sufficient privileges, they may unload EDR services, exploit vulnerable signed drivers, or load a compromised driver to gain kernel-level control — then kill or neuter security agents entirely.
• This technique — sometimes referred to as "Bring Your Own Vulnerable Driver" (BYOVD) — gives attackers near-total control over a system while rendering endpoint defenses moot.

Why This Matters — The Limits of EDR

(Even When Properly Deployed)

EDR is not a silver bullet.  While EDR represents a major step up from legacy antivirus, the techniques above show that motivated attackers can still slip past.  Detection by signature alone — or even by simple behavior rules — is frequently insufficient.

Attacks are increasingly stealthy and persistent.  Fileless malware, in-memory threats, and driver-level exploits are harder to detect, harder to remediate, and often leave little forensic trace.

If attackers disable EDR entirely, you're blind.  Once an adversary kills or disables your endpoint toolset, your entire first line of defense collapses.

In Short: Relying on EDR alone — or assuming that installing a popular security agent is "all done" — is EXTREMELY dangerous.

What Smarter Businesses Should Do Instead

In previous posts I have discussed the importance of having either a security professional on staff or partnering with a company that acts as your security professional for your business. This post is a tribute to the why; it is pertinent to actively manage your security or partner with a company, like Dynamic Intelligence, that does it for you. The threat is real and it's dangerous.

Given the threats listed above, businesses need a defense that's broader, smarter, and actively managed.  Here's how we recommend approaching security:

Layered Protection Beyond Endpoint Tools

• Supplement EDR (or Next-Gen AV) with a network-level monitoring, firewall policies, and strict application whitelisting.
• Limit or block the use of high-risk native tools (e.g., LOLBins) via application control, group policies, or attack-surface reduction rules.

Behavioral Monitoring & Threat Hunting

• Passive logging and alerting aren't enough.  You need active threat hunting — reviewing patterns over time, correlating events, and flagging subtle anomalies (e.g., unexpected driver loads, unusual memory behavior, or suspicious process injections).
• Real-time monitoring by skilled analysts can notice what automated tools miss.

Incident Response Planning & Rapid Remediation

• If a breach is detected, time is of the essence.  Organizations should be ready to isolate impacted systems, block further spread, and remediate swiftly.
• Having backups, clean restoration procedures, and rollback capabilities can make the difference between a minor incident and a catastrophic breach.

Managed SOC + Expert Human Oversight

• This is where a dedicated team — like the team at Dynamic Intelligence and their SOC — adds invaluable value.  Our approach combines technology with human context: behavior analytics, deep logs review, threat hunting, and a tailored response.
• With 24/7 monitoring, we provide real-time detection and mitigation — especially for advanced threats that aim to evade or disable automated endpoint tools.