Evading Endpoint Detection and Response Systems through DLL Sideloading Exploitation

Mgr. Vardaan Singh

Diplomová práce

Abstract:

Endpoint Detection and Response (EDR) systems play a critical role in safeguarding against malicious activities. However, adversaries keep changing their techniques to evade detection. This thesis delves into DLL based attacks, primarily focusing on DLL sideloading as a method to circumvent EDR systems. The study starts with an overview on DLL based attack methodologies concentrating on DLL sideloading to lay the foundation for its relevance in EDR evasion. It then explains how traditional DLL based attack is implemented, exposing its lack of efficiency. As a result, an alternative custom-made implementation of DLL sideloading is implemented to avoid detection by a specific EDR solution, the Windows Defender. The outcomes encompass an all-around understanding of DLL based attack methods, a comprehensive examination of existing implementation, and ultimately, a proposal for an optimized Windows Defender evasive strategy. Moreover, this thesis advises on countermeasures that can be employed to manage these tactics. This research contributes to the ongoing discourse on cybersecurity evasion strategies and helps enhance resilience of EDR systems from sophisticated threats.

Keywords

DLL based attacks, DLL sideloading, EDR evasion, code obfuscation, payload

Jazyk práce: angličtina

Datum vytvoření / odevzdání či podání práce: 17. 12. 2024

Obhajoba závěrečné práce

• Obhajoba proběhla 3. 2. 2025
• Vedoucí: prof. RNDr. Václav Matyáš, M.Sc.
• Oponent: Mgr. et Mgr. Jan Krhovják, Ph.D.

Masarykova univerzita

Fakulta informatiky

Magisterský studijní program / obor:
Computer Systems, Communication and Security / Information Security