EDR evasion techniques can be broadly grouped into three common categories: impairing security tools, hiding malicious execution, and blending into legitimate activity. The categories overlap, and more than one may show up in a single intrusion. Here’s how threat actors stay hidden while casing your environment.
1. Blinding the agent (EDR tampering)
“Blinding the agent” refers to blocking the EDR from seeing what the threat actors are doing. One technique attackers may use to impair security tools is bring your own vulnerable driver (BWOVD). In a BYOVD attack, threat actors abuse a legitimately signed driver that contains a known vulnerability or exposes privileged functionality. Exploiting the driver may give the attacker privileged kernel-level capabilities, depending on the driver and the vulnerability.
A valid digital signature can make a driver appear more trustworthy to security controls, but signing does not make the driver safe, and modern protections may use additional reputation, blocklist, and behavioral checks.
Once the driver is up and running, threat actors exploit that trust to disable the agent or unregister its security callbacks. Attackers may attempt to stop security processes, interfere with sensor components, or disrupt telemetry transmission. If successful, these actions can reduce defenders’ visibility before subsequent activity occurs. Without alerts, security professionals might not notice the suspicious behavior.
We’ve seen these techniques cause massive losses in the real world. For example, in 2024, the ALPHV group used stolen credentials to disable defenses at Change Healthcare. This allowed the group to move through Change Healthcare’s network over the course of nine days before deploying ransomware to encrypt the systems. ALPHV/BlackCat reportedly claimed to have accessed more than 6 TB of data, including medical and other private information. This figure should be considered an unverified threat-actor claim. In the end, Change Healthcare paid ALPHV’s \$22 million bitcoin ransom but didn’t get the data back.
2. Hiding (In-memory evasion)
For this category of EDR evasion, threat actors may attempt to evade user-mode monitoring by manipulating execution around Windows components such as the NT Layer DLL (NTDLL). The effectiveness of these techniques depends on the specific EDR’s telemetry and monitoring architecture.Because NTDLL handles how programs talk to the computer, threat actors like to run their malicious code from this stealthy location. They know automated security tools have blind spots here.
One of the most effective evasion tactics involves using direct syscalls. Direct or indirect system calls can be used to avoid user-mode API hooks and other specific monitoring mechanisms. They do not universally bypass EDR, because products may collect additional telemetry at other detection layers.
Threat actors also use fileless malware to avoid downloading any suspicious files onto the computer’s hard drive. The malicious payload may execute primarily in memory and may leave fewer traditional files on disk. The threat actors scramble or encrypt the code so it looks like gibberish and doesn’t set off any alarms.
Threat actors might also kick things up a notch by using process injection techniques to hide code inside trusted programs that your computer already runs. In process hollowing, threat actors empty out a trusted program and fill its shell with malware. In DLL sideloading, threat actors sneak a fake helper file into a trusted program’s folder so the program accidentally runs the bad code.
3. Blending in or living off the land (LOTL)
Threat actors can be even sneakier, using living off the land binaries (LOLBins) built into your computer’s operating system to execute commands. Because tools such as WMI and PowerShell are legitimate, routinely used components of the operating system, malicious use can be difficult to distinguish from normal administrative activity.
Threat actors may combine LOTL tactics with stolen credentials, but credential abuse is a related technique rather than a defining characteristic of LOTL activity. Automated security software often can’t distinguish between a real user and a threat actor when they’re both using an authentic username and password.
This method is one of the most popular ways threat actors get into vulnerable systems. A major report found that 82% of intrusions don’t use traditional malware files at all and instead use stolen passwords and built-in tools to sneak around unnoticed.
