Proactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
summary
A safe, containerized adversary rig demonstrates an observe–plan–act agent that generates Python code in memory, performs seven sequential goals (recon, staging, base64 exfil, UI pop, self‑delete) and successfully exfiltrates data with no persistent files under Windows Defender enhanced in a lab. Three scenarios show file‑less process injection, polymorphic payloads, living off the land via remote LLM APIs, pivot to local models (GEMMA4E2B) to lose network signals, and context‑file poisoning of agent markdowns. Proposed countermeasures are five pillars—notably AI‑driven intent correlation—plus telemetry, rules and playbooks; enterprise EDR testing remains outstanding.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:02AI threat landscape
- 3:53Agentic malware overview
- 5:19Attack scenarios intro
- 9:11Living of the land demo
- 14:40AI scenario walkthrough
- 16:49Demo takeaways
- 19:59Agent scenario explanation
- 21:24Agent demo timeline
- 24:13Defensive countermeasures
- 25:35Blending problem dilemma
- 26:40Three pillars of EDR
- 27:46Defense beyond EDR
- 29:50Key takeaways
- 31:15Actionable steps
- 32:20Q&A
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
52mFlying Under the Radar - New Security Evasion Techniques
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
26mWhen Models Write Malware: Defending Against On-demand Exploits
20mAttack & Defend, Defend & Monitor, Monitor & Respond
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter