Source: Lares
Author: Andrew Heller
URL: https://www.lares.com/blog/5things-your-edr-is-missing/
ONE SENTENCE SUMMARY:
Telemetry volume doesn’t equal detection; Lares purple teaming reveals five evasive TTPs and prescribes behavior-based monitoring to close visibility gaps.
MAIN POINTS:
- Assuming endpoint agents and SIEM ingestion provide security creates false confidence without detections.
- Purple Team Exercise Framework uses CTI-driven emulation, validation, and remediation to build threat resilience.
- Reflective .NET assembly loading in PowerShell evades disk-based controls and runtime-poor EDR visibility.
- Disabled or truncated PowerShell ScriptBlock logging blinds defenders to executed attacker code.
- OneDrive/Google Drive/Dropbox enable ingress and exfiltration that blends with normal business traffic.
- Signed LOLBins like InstallUtil.exe can proxy execution and bypass AMSI/ETW and EDR controls.
- Under-monitored utilities such as finger.exe enable stealthy outbound C2 communications.
- ADCS misconfigurations enable certificate-based escalation and persistence that’s hard to log and interpret.
- Ransomware detection often misses bulk encryption and extension changes, alerting only after major damage.
- Python execution frequently lacks guardrails, enabling “new PowerShell” abuse outside traditional monitoring.
TAKEAWAYS:
- Prioritize detections for attacker behaviors, not tool presence or sheer telemetry collection.
- Enable and correctly size ScriptBlock logging; hunt reflection indicators like
Assembly::Load. - Replace cloud-domain whitelisting with account/process behavior analytics for sync and exfil patterns.
- Treat signed binaries as untrusted; alert on defense-impairment and suspicious LOLBin usage.
- Monitor identity abuse and ransomware outcomes: ADCS escalation signals and mass file rename/modification spikes.