Pith. sign in

REVIEW 6 major objections 5 minor 71 references

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

T0 review · 6 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A knowledge-grounded, closed-loop multi-agent framework can turn publicly documented EDR evasion techniques into working payloads, bypassing all seven commercial endpoint security platforms it tested.

desk verdict A real, built system with a solid KB-amplification result, but the headline 90% evasion rates rest on a 30-second heartbeat window and decay noticeably after one month, so the numbers are encouraging upper bounds, not durable EDR bypass rates. read the letter →

arxiv 2608.01639 v1 pith:BB26EG75 submitted 2026-08-03 cs.CR cs.OS

Weifeng Yuan , Wenbo Guo , Qingyun Du , Jun Chen , Feng Dong , Haoyu Wang , Yang Liu This is my paper · ORCID
classification cs.CRcs.OS
keywords EDRevasionmulti-agentorchestrationknowledgebaseshellcodeloaderpolymorphicgenerationclosed-loopfeedbackLLMsecurityendpointdetectionandresponse
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the knowledge needed to evade modern endpoint detection and response (EDR) products is already public and can be systematically operationalized by an autonomous system: a multi-agent pipeline reads threat intelligence, detection rules, and proof-of-concept code, plans an attack, generates polymorphic payloads, runs them against live defenses, and refines strategy from the alerts. Across seven commercial endpoint security platforms the system bypassed every target, reaching 90% evasion against Windows Defender and 86.7% against Trend Micro AV. The paper further claims that a structured knowledge base is the decisive component, raising the evasion success of small open-weight models from 27–53% up to 43–83%, close to large proprietary models. A sympathetic reader would care because, if true, this turns EDR resilience testing from a manual expert activity into a repeatable automated benchmark, and it exposes a systemic blind spot: payloads that execute inside trusted processes, such as DLL sideloading, outperform standalone executables. The paper's own one-month retest shows evasion rates decaying as cloud telemetry and sandbox submissions generate new signatures, so the headline numbers measure short-horizon evasion rather than long-term stealth.

What carries the argument

The load-bearing mechanism is the Detection-Aware Knowledge Base, a hybrid relational-plus-vector store that turns unstructured threat intelligence, expert analyses, and proof-of-concept code into a structured taxonomy of evasion techniques tagged by loader stage and risk level, OPSEC constraints, and historical failure records; in the implementation it holds 19 evasion techniques, 5 encoding schemes, 68 OPSEC constraints, and 1,537 detection rules. Around it, a multi-agent pipeline with roles for strategy, coding, building, and debugging plans blueprints, synthesizes polymorphic C++ source from verified snippets under stealth constraints, compiles, and self-repairs, while a Tester agent executes samples against live EDRs and uses alert-timing heuristics to infer root causes that update the history. The knowledge base carries the argument because it prevents functional hallucination by grounding code in verified snippets and enables semantic-level pivoting between tradecrafts when one approach is blocked.

What would settle it

Instrument a lab EDR so it logs the exact detecting component for every alert, run the same sample suite on telemetry-connected hosts for 30 days without submitting samples to public sandboxes, and compare the ground-truth detection logs with the framework's inferred root causes and survival times; if a substantial share of samples is flagged only after the first 30 seconds, or the inferred causes disagree with the logs, the 30-second criterion and heuristic inference overstate resilience.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that EDR bypass can be modeled as a closed-loop orchestration problem rather than a one-shot payload-generation trick. The system divides the shellcode-loader lifecycle into six stages, selects and composes evasion primitives for each stage from its knowledge base, has agents generate polymorphic C++ and compile it, then infers detection root causes from OS-observable telemetry such as file deletion, process termination, network failure, and delayed termination, and feeds those inferences back into the planner. In evaluation it bypassed all seven targets, with peak success of 90% against Windows Defender and 86.7% against Trend Micro AV, and 62.9% of generated samples triggered five or fewer detections in an aggregate antivirus scan. The authors are explicit that the contribution is not the discovery of new evasion primitives but the autonomous, knowledge-grounded orchestration of known techniques, with the knowledge base lifting 8B open-weight models from 27–53% to 43–83% success.

Load-bearing premise

The load-bearing premise is that surviving 30 seconds with a stable command-and-control heartbeat, together with the heuristic mapping of alert timing to root causes, is an adequate measure of evasion; the paper's own one-month retest shows rates decaying sharply (for example, Windows Defender from 87.8% to 76.7% and Bitdefender from 50.0% to 37.8%), so if true resilience means avoiding retrospective cloud-based detection for days, the headline rates overstate it.

Editorial extensions

If this is right

  • Current commercial EDRs remain vulnerable to polymorphic, knowledge-driven attacks assembled entirely from publicly documented techniques.
  • A structured knowledge base acts as an intelligence amplifier: computationally efficient 8B models approach large proprietary models' evasion rates, so this kind of assessment no longer requires the most capable LLM.
  • Techniques that hide in trusted execution contexts, such as DLL sideloading, are a systematic blind spot across tested defenses and deserve vendor attention.
  • EDR resilience assessment can be automated and run continuously, turning scattered public threat intelligence into repeatable stress tests.
  • Evasion is temporal: rates decay within a month as cloud telemetry and sandbox submissions generate new signatures, so ongoing mutation, not one-shot generation, is the realistic operating mode.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Our inference: the 30-second survival criterion likely understates true resilience; the paper's one-month decay suggests the binding constraint on such attacks is retrospective cloud analysis, so a stronger benchmark would measure survival over days or weeks without sandbox submission.
  • Our inference: the knowledge-base-as-amplifier result plausibly transfers to other security code-generation tasks where raw LLMs hallucinate, such as detection-rule authoring or exploit scaffolding, where verified snippets and OPSEC constraints would play the same grounding role.
  • Our inference: the alert-inference heuristics (file deletion within 5 seconds, process death within 30 seconds, termination after 2 minutes) are directly testable; an EDR that logs its own detecting component would let a follow-up study measure attribution accuracy instead of assuming it.
  • Our inference: because evaluation covers only shellcode loaders, extending the same orchestration to script-based vectors such as PowerShell or WMI could reveal different blind spots and is a natural next experiment.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper presents AutoBypass, a multi-agent LLM framework for automated EDR evasion assessment. A knowledge base is built from public blogs, PoC repositories, detection-rule databases, and OPSEC documents; a Strategist agent selects evasion techniques, a Coder synthesizes polymorphic C++ shellcode loaders, a Builder compiles and pre-checks binaries, and a Tester executes samples against live commercial EDRs, infers detection causes from OS telemetry, and feeds failures back into the knowledge base. The evaluation against seven commercial endpoint products reports peak evasion rates of 90% against Windows Defender and 86.7% against Trend Micro, claims that all seven targets were bypassed, and uses ablations to argue that the knowledge base raises 8B open-weight models from 27--53% to 43--83% evasion, approaching large proprietary models. The paper also includes a one-month retest showing decay in evasion rates and an explicit acknowledgment that alert reasoning is heuristic and that the full knowledge base is withheld from release.

Significance. If the reported numbers survive a more defensible success definition, this is a useful contribution to automated adversary emulation. The system was actually built and run; the primary metric is measured against external commercial products rather than a self-defined detector; the ablation study is informative; and the one-month retest plus the explicit discussion of alert-inference limits are signs of honest reporting. The paper does not rely on circular reasoning: the knowledge base is built from public sources and used for generation, while success is judged by the target EDRs themselves. The main weaknesses are that the success metric measures only 30 seconds of C2 heartbeat rather than the full detection-and-response loop, that the one-month decay is confounded by the authors' own VirusTotal submissions, that the baseline comparison uses different denominators, and that the released artifact excludes the full knowledge base, so the central claims are not independently reproducible as described.

major comments (6)
  1. [4.3.3 and 5.1; Table 8] The success metric is load-bearing and currently inconsistent. Section 4.3.3 defines evasion as establishing a C2 connection and maintaining heartbeat for over 30 seconds without being blocked, while Section 5.1 restates the protocol as executing 'without triggering EDR alerts.' The Tester monitors OS-level phenomena (process survival, file deletion, network connectivity) and does not query the EDR management console for alerts that are logged but not immediately acted upon, so a sample that is flagged afterwards by cloud retro-analysis is counted as a success. Table 8 is direct evidence that the window is too short: the same protocol's rates drop from 87.8% to 76.7% for Windows Defender, 85.6% to 73.3% for Trend Micro, and 50.0% to 37.8% for Bitdefender after one month. Because the headline RQ1, RQ3, and 'bypassed every target' claims all inherit this metric, the authors should report both immediate survival and post-retrospective detection from the EDR consoles at longer horizons (e.g., 24 hours and one week), and re-state the claims accordingly.
  2. [5.3, Figure 6, and Table 8] The one-month robustness claim is confounded by the authors' own VirusTotal submissions. The paper states that all 630 AutoBypass samples were uploaded to VirusTotal for the broader assessment, and later attributes the one-month decay partly to 'public sandbox submission accelerat[ing] signature generation.' Since the retested samples are the same samples that were already submitted to VirusTotal, the measured decay conflates vendor cloud telemetry with the effect of the authors' own VT exposure. To support the temporal-robustness interpretation, the authors should retest a held-out set of successful samples that were never uploaded to VirusTotal, or at least quantify the decay separately for VT-exposed and non-exposed samples.
  3. [Table 7] The comparison against BOAZ, Inceptor, and Dante-7B is not apples-to-apples. The table note says 'Evasion rates are calculated based on successfully generated samples, not total generation attempts,' while the AutoBypass rates in Table 6 are reported as successes over 30 iterations per cell. If the baseline rates are conditional on successful compilation/generation and the AutoBypass rates are marginal over attempts, the comparison inflates the gap. The authors should report both marginal and condition-on-success rates for every method with explicit denominators.
  4. [Table 5 and Section 7] The alert root-cause inference is acknowledged to be heuristic, yet it drives the closed-loop adaptation that is central to the framework's contribution. The mapping from telemetry phenomena to root cause (static detection, behavioral blocking, network interception, memory scanning) is never validated, and the paper concedes it 'cannot guarantee absolute attribution accuracy.' The authors should validate the inference against a ground-truth source where available, for example Elastic Security's verbose alerts, or against a set of samples whose triggering mechanism is independently known, and report a confusion matrix or agreement rate. Without that, the historical-feedback mechanism and the RQ2 conclusions about component contributions rest on unverified attributions.
  5. [Tables 6, 9, and 10] The statistical support is insufficient for several of the paper's comparative claims. Each primary cell has N=30, and Table 8 has N=90, but no confidence intervals or significance tests are reported; differences such as 90.0% vs 86.7% vs 83.3% are within plausible sampling error, and zero-success cells (e.g., DeepSeek-V3 and the 8B models against Bitdefender and Elastic) have wide binomial intervals. The claim that 8B models approach or match large proprietary models needs error bars or exact tests (e.g., Fisher's exact test) on the underlying counts, not just point estimates.
  6. [Artifacts] The Artifacts section explicitly states that withholding the complete pre-populated knowledge base 'reduces the direct reproducibility of our core claims.' Since the KB is the central contribution and the basis for the RQ2/RQ3 conclusions, releasing only three of the least effective techniques makes it impossible for an independent party to reproduce the main experiments. The authors should specify exactly what a third party can verify with the released subset, provide a full schema and example entries for the withheld portion, and state whether the evaluation harness can be run end-to-end on the released subset.
minor comments (5)
  1. [Figure 6] The x-axis categories '0' and '1-5' are ambiguous, and the text says 'five or fewer detections' while the figure treats zero as a separate bucket; the authors should clarify whether the 62.9% figure includes the zero-detection bucket.
  2. [5.3] The knowledge-retrieval quality assessment is based on two experts labeling 691 unique queries, but the paper reports no inter-rater reliability; adding Cohen's kappa or a disagreement count would make the 82.1% hit-rate claim more robust.
  3. [Section 7] The limitation section mentions the binary-splitting tool 'VirTest' without a citation or reference; please add a source or remove the name.
  4. [Abstract and Section 1] The phrase 'Detection-A ware' appears as a line-break artifact in the abstract and introduction; this should be corrected to 'Detection-Aware.'
  5. [Tables 9 and 10] For cells with zero successful evasions, the average token cost is listed as N/A, which is correct, but the corresponding row still reports a success rate of 0.0%; consider adding a footnote that the token statistics are undefined rather than zero for those cells.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation: evasion rates are measured against independent commercial EDRs, and the KB is an input rather than the success criterion; only minor non-load-bearing self-citations appear.

full rationale

The central claim (peak 90%/86.7% evasion and KB-driven gains for 8B models) is an empirical measurement against seven external commercial products, not a derivation from the KB. Section 4.3.3 defines success operationally as 'the payload establishing a stable C2 connection and maintaining heartbeat communication for over 30 seconds,' and the Tester monitors OS-level state (process survival, file existence, network connectivity) rather than querying the EDR alert console. This is a construct-validity limitation (the paper itself says in Section 7 that heuristic alert inference 'cannot guarantee absolute attribution accuracy'), but it is not circular: the measured outcome is not contained in the KB or in the agent prompts. The KB is constructed from public sources (Section 4.1.1: 'we collected 1351 web pages... final KB contains 19 AV/EDR evasion techniques...') and functions as an input to sample generation. The ablation in Table 9 compares Full KB versus No KB on the same external metric, so the 27-53% to 43-83% improvement is a measured difference, not a fitted parameter renamed as a prediction. The only self-referential elements are citations to the authors' own prior work: [28] for Google Search API-based source discovery and [29] for the value of extracting structured knowledge from unstructured reports. Both are supporting precedents, not load-bearing uniqueness claims; [29] is accompanied by independent citation [41], and neither defines the evasion metric. No self-definitional equation, Ansatz smuggled by citation, or author-imported uniqueness theorem appears. Under the hard rule requiring a quoted reduction, no circular step can be exhibited, so the circularity score is low.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The claims rest on a small set of empirical and modeling premises rather than mathematical axioms. The main free parameters are hand-chosen time thresholds used to define evasion success and to infer detection root causes from telemetry; the paper provides no sensitivity analysis for either. Domain assumptions about EDR architecture and the representativeness of public detection rules are stated in the background and threat model but not independently verified for each product. No new entities are introduced. The authors explicitly acknowledge the KB is withheld and alert inference is heuristic, which is consistent with this ledger.

free parameters (2)
  • Evasion success heartbeat window = 30 seconds
    Used in §4.3.3 to define a successful evasion as a stable C2 connection with heartbeat for over 30 seconds. This hand-chosen threshold directly defines all reported evasion rates; the one-month retest in Table 8 shows rates decay over longer horizons, so rates are sensitive to this choice.
  • Alert inference time thresholds = 5s deletion, 30s termination, 2min delayed termination
    Used in §4.3.3 to classify root causes as static, behavioral, network, or memory scanning. Hand-chosen without calibration; the authors acknowledge (§7) that inference accuracy is not guaranteed, and misclassification would misdirect the closed-loop strategy evolution.
assumptions (4)
  • domain assumption Commercial EDRs implement the layered detection architecture in §2.1: user-mode hooks, kernel callbacks, ETW, memory scanning, and cloud correlation.
    The six-stage loader taxonomy and the entire KB design assume this internal model; the paper does not verify internals of each of the seven products.
  • domain assumption Open-source detection rules (YARA, Sigma, Elastic) and OPSEC guidelines are representative of the detection logic of the tested commercial products.
    The Builder pre-filters samples against these rules (§4.2.3); if vendor private rules differ substantially, the pre-check and strategy guidance may be misaligned.
  • domain assumption An attacker with standard user privileges and initial access can iterate against a live EDR in a VM and observe OS telemetry.
    Threat model in §3; results may not transfer to environments with tamper protection, no iterative feedback, or no ability to revert clean VM snapshots.
  • domain assumption Root causes of EDR blocks can be inferred from observable OS telemetry using the heuristic mapping in Table 5.
    The closed-loop improvement mechanism depends on these inferences, and the authors acknowledge (§7) they cannot guarantee absolute attribution accuracy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration." pith.science (2026). https://pith.science/paper/BB26EG75

@misc{pith2026260801639,
  author       = {Pith},
  title        = {Pith review of: Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BB26EG75}},
  note         = {Machine review of arXiv:2608.01639}
}
read the original abstract

Public reports and open-source resources expose many EDR evasion techniques, but it remains unclear whether commercial Endpoint Detection and Response (EDR) systems can withstand these documented attacks. Evaluating them requires turning fragmented security knowledge into working payloads and refining those payloads from opaque alerts, tasks that existing automation does not address. We present AutoBypass, a knowledge-grounded, closed-loop multi-agent framework for automated EDR resilience assessment. A Detection-Aware Knowledge Base structures threat intelligence, expert analyses, and open-source proofs of concept into evasion techniques and operational constraints. Agents use this knowledge to plan attacks, generate polymorphic code, and compile binaries, while a telemetry-driven reasoning engine diagnoses failures and feeds corrective evidence back into the strategy. Across seven commercial endpoint security platforms, AutoBypass bypassed every target, reaching 90% evasion against Windows Defender and 86.7% against Trend Micro AV. Ablations show that the knowledge base raises the success rates of 8B open-weight models from 27--53% to 43--83%, bringing them close to large proprietary models. These results demonstrate a systematic way to operationalize public security knowledge for continuous, automated assessment of EDR resilience.

Figures

Figures reproduced from arXiv: 2608.01639 by the authors.

Figure 1
Figure 1. Overview of EDR Architecture These sensors collaborate to establish a multi-layered detection method. At the user level, EDRs inject hooks into critical libraries, such as ntdll.dll, to intercept API calls and identify suspicious behavioral patterns like process injection. To ensure visibility even if user-mode hooks are bypassed, EDRs utilize kernel-level callbacks (e.g., PsSetCreateProcessNotifyRoutine) and Event … view at source ↗
Figure 2
Figure 2. Overview of a Shellcode Loader As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. System Overview of AutoBypass Prompts for Knowledge Extraction Task 1: Offensive Technique Extraction Extract the C++ code snippet for the described injection technique and classify its execution stage. Format the output strictly as a JSON tuple: T=〈Name, Description, CodeSnippet, RiskLevel, StageTag〉 Task 2: OPSEC Constraint Summarization Summarize the following OPSEC advice into a concise constraint (e.g., ‘Do not… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Prompts used for knowledge construction the shellcode loader lifecycle (detailed in §2.2). Listing 1 illustrates a concrete entry. Additionally, this category includes encoding schemes (e.g., XOR, AES) paired with decryption stubs to obfus￾cate static signatures. To en…
Figure 5
Figure 5. Figure 5: Prompts for the Strategist and Coder Agents in a baseline environment with the EDR disabled, it verifies that the sample functions correctly (e.g., establishes C2 connection, executes commands). Only samples passing this sanity check proceed to the second phase, where …
Figure 6
Figure 6. Figure 6: Comparison of VirusTotal Detection Results [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

71 extracted references · 55 canonical work pages

  1. [1]

    Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, Davide Balzarotti, Giovanni Vigna, and Christopher Kruegel. 2020. When malware is packin’heat; limits of machine learning classifiers based on static analysis features. InNetwork and Distributed System Security Symposium. Internet Society

    work page 2020

  2. [2]

    Kotaiba Alachkar, Dirk Gaastra, Eduardo Barbaro, Michel van Eeten, and Yury Zhauniarovich. 2025. EvilEDR: Repurposing EDR as an Offensive Tool. In34th USENIX Security Symposium (USENIX Security 25). 587–605

    work page 2025

  3. [3]

    Bushra A Alahmadi, Louise Axon, and Ivan Martinovic. 2022. 99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms. In31st USENIX Security Symposium (USENIX Security 22). 2783–2800

    work page 2022

  4. [4]

    Anthropic. 2025. Disrupting the first reported AI-orchestrated cyber espionage campaign. https://www.anthropic.com/news/disrupting-AI-espionage, Accessed: Dec 20, 2025

    work page 2025

  5. [5]

    Kyle Avery. 2025. Training Specialist Models: Automating Malware Development. https://blackhat.com/us-25/briefings/schedule/#training-specialist-models- automating-malware-development-46238

    work page 2025

  6. [6]

    Avira. [n. d.]. Avira Internet Security. https://www.avira.com/en/internet- security, Accessed: Jun 6, 2026

    work page 2026

  7. [7]

    BishopFox. 2026. sliver - Adversary Emulation Framework. https://github.com /BishopFox/sliver, Accessed: Jan 23, 2026

    work page 2026

  8. [8]

    Bitdefender. 2026. GravityZone Endpoint Detection and Response (EDR). https:// www.bitdefender.com/en-us/business/products/endpoint-detection-response, Accessed: Jan 21, 2026. 13 , , Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

    work page 2026

Show all 71 references
  1. [9]

    Bitdefender. 2026. What is DLL Sideloading. https://techzone.bitdefender.com/e n/tech-explainers/what-is-dll-sideloading.html, Accessed: May 20, 2026

    2026

  2. [10]

    calccrypto. 2024. A C++ Encryption Library. https://github.com/calccrypto/Encr yptions

    2024

  3. [11]

    Ibai Castells. 2025. The Evolution of EDR Bypasses: A Historical Timeline. https://www.covertswarm.com/post/timeline-of-edr-bypass-techniques

    2025

  4. [12]

    Raphael Labaca Castro, Corinna Schmitt, and Gabi Dreo. 2019. Aimed: Evolv- ing malware with genetic programming to evade detection. In2019 18th IEEE international conference on trust, security and privacy in computing and commu- nications/13th ieee international conference on ...

    2019

  5. [13]

    2020.New Snort, ClamA V coverage strikes back against Cobalt Strike

    Cisco Talos - Jonathan Munshaw. 2020.New Snort, ClamA V coverage strikes back against Cobalt Strike. Technical Report. https://blog.talosintelligence.com/cover age-strikes-back-cobalt-strike-paper/, Accessed: Jun 8, 2026

    2020

  6. [14]

    CrowdStrike. 2023. DLL Side-Loading: How to Combat Threat Actor Evasion Techniques. https://www.crowdstrike.com/en-us/blog/dll-side-loading-how-to- combat-threat-actor-evasion-techniques/, Accessed: Dec 20, 2025

    2023

  7. [15]

    CrowdStrike. 2023. Machine Learning (ML) & Cybersecurity How is ML used in Cybersecurity? https://www.crowdstrike.com/en- us/cybersecurity- 101/artificial-intelligence/machine-learning/, Accessed: Dec 20, 2025

    2023

  8. [16]

    Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Masterkey: Automated jailbreak across multiple large language model chatbots.arXiv preprint arXiv:2307.08715 (2023)

    2023 arXiv

  9. [17]

    Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. 2024. PentestGPT: Evaluating and harnessing large language models for automated penetration testing. In33rd USENIX Security Symposium (USENIX Se...

    2024

  10. [18]

    Yinlin Deng, Chunqiu Steven Xia, Haoran Peng, Chenyuan Yang, and Lingming Zhang. 2023. Large language models are zero-shot fuzzers: Fuzzing deep-learning libraries via large language models. InProceedings of the 32nd ACM SIGSOFT international symposium on software testing and ...

    2023

  11. [19]

    dobin. 2024. The (Anti-)EDR Compendium. https://blog.deeb.ch/posts/how-edr- works/

    2024

  12. [20]

    Elastic. [n. d.]. Detection and response from Elastic Security for Endpoint. https: //www.elastic.co/endpoint-detection-response, Accessed: Jan 21, 2026

    2026

  13. [21]

    Elastic. 2025. Configure an Integration Policy for Elastic Defend. https://ww w.elastic.co/docs/solutions/security/configure-elastic-defend/configure-an- integration-policy-for-elastic-defend Accessed: Jun 9, 2026

    2025

  14. [22]

    Elastic. 2025. Malicious File - Detected - Elastic Defend. https://www.elastic.co /guide/en/security/8.19/malicious-file-detected-elastic-defend.html Accessed: Jun 9, 2026

    2025

  15. [23]

    elastic. 2026. Elastic Security detection content for Endpoint. https://github.com /elastic/protections-artifacts

    2026

  16. [24]

    Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang. 2024. Llm agents can autonomously exploit one-day vulnerabilities.arXiv preprint arXiv:2404.08144 (2024)

    2024 arXiv

  17. [25]

    Fortra. 2025. Cobalt Strike. https://www.cobaltstrike.com/, Accessed: Jan 23, 2026

    2025

  18. [26]

    Gartner. 2019. Market Guide for Endpoint Detection and Response Solutions. https://www.gartner.com/en/documents/3978685, Accessed: Dec 20, 2025

    2019

  19. [27]

    Akul Goyal, Xueyuan Han, Gang Wang, and Adam Bates. 2023. Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems. In30th Network and Distributed System Security Symposium

    2023

  20. [28]

    Wenbo Guo, Chengwei Liu, Limin Wang, Jiahui Wu, Zhengzi Xu, Cheng Huang, Yong Fang, and Yang Liu. 2024. PackageIntel: Leveraging Large Language Models for Automated Intelligence Extraction in Package Ecosystems.arXiv preprint arXiv:2409.15049(2024)

    2024

  21. [29]

    Wenbo Guo, Shiwen Song, Jiaxun Guo, Zhengzi Xu, Chengwei Liu, Haoran Ou, Mengmeng Ge, and Yang Liu. 2026. Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages.arXiv preprint arXiv:2601.16458(2026)

    2026

  22. [30]

    Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer

  23. [31]

    2023.Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems.No Starch Press

    Matt Hand. 2023.Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems.No Starch Press

    2023

  24. [32]

    Wajih Ul Hassan, Adam Bates, and Daniel Marino. 2020. Tactical provenance analysis for endpoint detection and response systems. In2020 IEEE symposium on security and privacy (SP). IEEE, 1172–1189

    2020

  25. [33]

    Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. 2019. NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. In26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California...

    2019

  26. [34]

    jermanuts. 2024. Collection of links on bad opsec. https://github.com/jermanuts /bad-opsec

    2024

  27. [35]

    Helvio Carvalho Junior. 2024. HookChain: A new perspective for Bypassing EDR Solutions.arXiv preprint arXiv:2404.16856(2024)

    2024 arXiv

  28. [36]

    Kaspersky. [n. d.]. Kaspersky Next EDR Expert. https://www.kaspersky.com/en terprise-security/endpoint-detection-response-edr, Accessed: Jan 21, 2026

    2026

  29. [37]

    Kaspersky. 2025. How we trained an ML model to detect DLL hijacking. https: //securelist.com/building-ml-model-to-detect-dll-hijacking/117565/, Accessed: Dec 20, 2025

    2025

  30. [38]

    klezVirus. 2023. inceptor. https://github.com/klezVirus/inceptor, Accessed: Jan 17, 2026

    2023

  31. [39]

    langchain-ai. 2026. langgraph. https://github.com/langchain-ai/langgraph, Accessed: Jan 14, 2026

    2026

  32. [40]

    2025.Automated Code Transformations to Bypass and Understand Endpoint Detection and Response (EDR) Systems

    Andrea Lepori. 2025.Automated Code Transformations to Bypass and Understand Endpoint Detection and Response (EDR) Systems. Master’s thesis. ETH Zurich

    2025

  33. [41]

    Xiaojing Liao, Kan Yuan, XiaoFeng Wang, Zhou Li, Luyi Xing, and Raheem Beyah. 2016. Acing the ioc game: Toward automatic discovery and analysis of open-source cyber threat intelligence. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security. 755–766

    2016

  34. [42]

    McAfee. [n. d.]. McAfee LiveSafe. https://www.mcafee.com/en-us/antivirus/m cafee-livesafe.html, Accessed: Jun 6, 2026

    2026

  35. [43]

    Microsoft. [n. d.]. Event Tracing for Windows. https://learn.microsoft.com/en- us/windows-hardware/test/wpt/event-tracing-for-windows, Accessed: Jan 28, 2026

    2026

  36. [44]

    Microsoft. 2019. Event Viewer. https://learn.microsoft.com/en-us/shows/inside/ event-viewer, Accessed: Jan 23, 2026

    2019

  37. [45]

    Microsoft. 2025. Microsoft Defender Antivirus in Windows. https://learn.micr osoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows, Accessed: Jan 21, 2026

    2025

  38. [46]

    Sadegh M Milajerdi, Birhanu Eshete, Rigel Gjomemo, and VN Venkatakrishnan

  39. [47]

    Sadegh M Milajerdi, Rigel Gjomemo, Birhanu Eshete, Ramachandran Sekar, and VN Venkatakrishnan. 2019. Holmes: real-time apt detection through correlation of suspicious information flows. In2019 IEEE symposium on security and privacy (SP). IEEE, 1137–1152

    2019

  40. [48]

    MITRE ATT&CK. 2025. Reflective Code Loading. https://attack.mitre.org/techn iques/T1620/

    2025

  41. [49]

    monoxgas. 2022. sRDI. https://github.com/monoxgas/sRDI

    2022

  42. [50]

    Palo Alto Networks Unit 42. 2024. TA Phone Home: EDR Evasion Testing Reveals Extortion Actor’s Toolkit. https://unit42.paloaltonetworks.com/edr-bypass- extortion-attempt-thwarted/, Accessed: Dec 20, 2025

    2024

  43. [51]

    2025.AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks

    Palo Alto Networks Unit 42. 2025.AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks. Technical Report. https://unit42.paloaltonetwo rks.com/adaptixc2-post-exploitation-framework/, Accessed: Jun 8, 2026

    2025

  44. [52]

    Fabio Pierazzi, Feargus Pendlebury, Jacopo Cortellazzi, and Lorenzo Cavallaro

  45. [53]

    Gustavo Sandoval, Hammond Pearce, Teo Nys, Ramesh Karri, Siddharth Garg, and Brendan Dolan-Gavitt. 2023. Lost at c: A user study on the security implications of large language model code assistants. In32nd USENIX Security Symposium (USENIX Security 23). 2205–2222

    2023

  46. [54]

    SentinelOne. 2025. Decrypting SentinelOne Cloud Detection | The Behavioral AI Engine in Real-Time CWPP. https://www.sentinelone.com/blog/decrypting- sentinelone-detection-the-behavioral-ai-engine-in-real-time-cwpp/, Accessed: Dec 20, 2025

    2025

  47. [55]

    In 2020 IEEE symposium on security and privacy (SP)

    Intriguing properties of adversarial ml attacks in the problem space. In 2020 IEEE symposium on security and privacy (SP). IEEE, 1332–1349

    2020

  48. [56]

    Wei Song, Xuezixiang Li, Sadia Afroz, Deepali Garg, Dmitry Kuznetsov, and Heng Yin. 2022. Mab-malware: A reinforcement learning framework for blackbox gen- eration of adversarial malware. InProceedings of the 2022 ACM on Asia conference on computer and communications security....

    2022

  49. [57]

    Joseph Spracklen, Raveen Wijewickrama, AHM Nazmus Sakib, Anindya Maiti, and Bimal Viswanath. 2025. We have a package for you! a comprehensive analysis of package hallucinations by code generating LLMs. In34th USENIX Security Symposium (USENIX Security 25). 3687–3706

    2025

  50. [58]

    SigmaHQ. 2026. sigma. https://github.com/SigmaHQ/sigma

    2026

  51. [59]

    thomasxm. 2025. BOAZ_beta. https://github.com/thomasxm/BOAZ_beta, Accessed: Jan 14, 2026

    2025

  52. [60]

    Trend Micro. [n. d.]. PC-cillin. https://www.trendmicro.com/zh_hk/forHome/tri al.html, Accessed: Jan 21, 2026

    2026

  53. [61]

    TheWover. 2024. donut. https://github.com/TheWover/donut

    2024

  54. [62]

    VMRAY. 2024. Advantage Attacker: EDR Bypass Tools | Scarecrow. https: //www.vmray.com/advantage-attacker-edr-bypass-tools-scarecrow/, Accessed: Dec 20, 2025

    2024

  55. [63]

    Qi Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Jungh- wan Rhee, Zhengzhang Chen, Wei Cheng, Carl A Gunter, et al. 2020. You are what you do: Hunting stealthy malware via data provenance analysis.. InNDSS. 14 Mutate to Bypass: Autonomous Endpoint Evasion ...

    2020

  56. [64]

    VirusTotal. 2022. Threat Hunting with VirusTotal. https://blog.virustotal.com/ 2022/11/threat-hunting-with-virustotal.html, Accessed: Jun 9, 2026

    2022

  57. [65]

    Chunqiu Steven Xia, Matteo Paltenghi, Jia Le Tian, Michael Pradel, and Lingming Zhang. 2024. Fuzz4all: Universal fuzzing with large language models. InPro- ceedings of the IEEE/ACM 46th International Conference on Software Engineering. 1–13

    2024

  58. [66]

    Yara-Rules. 2022. Repository of yara rules. https://github.com/Yara-Rules/rules

    2022

  59. [67]

    x64dbg. 2026. x64dbg: An open-source user mode debugger for Windows. https: //x64dbg.com/, Accessed: February 3, 2026

    2026

  60. [68]

    Chijin Zhou, Lihua Guo, Yiwei Hou, Zhenya Ma, Quan Zhang, Mingzhe Wang, Zhe Liu, and Yu Jiang. 2023. Limits of i/o based ransomware detection: An imitation based attack. In2023 IEEE symposium on security and privacy (SP). IEEE, 2584–2601. 15

    2023

  61. [70]

    Chendong Yu, Yang Xiao, Jie Lu, Yuekang Li, Yeting Li, Lian Li, Yifan Dong, Jian Wang, Jingyi Shi, Defang Bo, et al. 2024. File hijacking vulnerability: The elephant in the room. InProceedings 2024 Network and Distributed System Security Symposium (2024). https://api. semantic...

    2024

  62. [2019]

    InProceedings of the 2019 ACM SIGSAC conference on computer and communications security

    Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. InProceedings of the 2019 ACM SIGSAC conference on computer and communications security. 1795–1812

    2019

  63. [2020]

    Unicorn: Runtime provenance-based detector for advanced persistent threats.arXiv preprint arXiv:2001.01525(2020)

    2020 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.