🛡️ DEFCON Workshop: Putting EDRs in Their Place

💀 Killing and Silencing EDR Agents Like an Adversary

• Setup

• EDR Killing

• Custom EDR Evasion

🎯 What You’ll Do

Each student will be provisioned their own lab environment to: - 🔍 Investigate a live EDR agent: discover its hooks, logs, and reach - ⚔️ Compile & deploy EDR killers used by known threat groups - 🔕 Silence the agent-to-tenant communication path (shhh...) - 🧠 Reverse engineer tool behaviors in real time - 🛠️ Write custom C/C++ code to replicate evasion techniques - 🧬 Build your own EDR killer and silencer—like a boss

👨‍💻 Format

✔️ Hands-on labs in your own hosted VM
✔️ Pre-loaded tools, samples, and EDR emulator
✔️ Instructor-led reverse engineering and live coding
✔️ No filler. Just killin’.

💻 Requirements

Make sure you're ready to go with: - ✅ A modern browser (for the hosted lab) - ✅ Some knowledge of C/C++ (or willingness to jump in) - ✅ Passion for pain, pointers, and patchless pwnage

🛠️ Tools & Techniques Covered

I. 👋 Introduction (10 min) — Ryan & Aaron

• Welcome and introductions
• Workshop overview:
• 🔍 Our focus: EDR killing vs. silencing — what’s the difference, who uses these tactics, and why?
• 🧰 Tools & techniques preview
• 🧪 Structure:
  • Use and analyze real-world tools
  • Write your own weaponized versions
• 👑 Ground rules:
• Participate, ask questions, stay respectful, share thoughts!

II. 🧱 Environment Setup (25 min) — Aaron

Goal: Get your personal lab ready for action.

• 🔗 GitHub lab instructions
• 🧪 Pluralsight Lab: Setup free accounts
• ✅ Verify lab access
• 🛠️ Troubleshooting help if needed

III. 🧠 Introduction to OpenEDR (40 min) — Ryan

Goal: Understand the EDR we’ll be targeting.

• What is OpenEDR? Why it was selected? Alternatives?
• 🧬 OpenEDR internals:
• Logging behavior
• Detection capabilities
• 🧪 Run some commands → Analyze logs

IV. 💣 EDR Killing with EDRSandBlast (20 min) — Ryan

Goal: Use a real-world EDR killer tool seen in ransomware campaigns.

• Overview of EDRSandBlast
• 👨‍💻 Code walkthrough in Visual Studio
• 🔨 Build it
• 🚀 Execute it:
• Run post-exploit commands → verify nothing is logged
• 🩹 Disable EDRSandBlast → see logs come back online

V. 🕶️ EDR Silencing Methods (25 min) — Ryan

Goal: Disable EDR telemetry without killing the agent.

• 📡 Silencing techniques:
• Add-DnsClientNrptRule
• GenericDNSServers registry key
• (If time) PendingFileRenameOperations
• ✅ Verify agent stays "alive" but blind

☕ BREAK (15 min)

Take a breather. Stretch. Reflect on what you’ve just done to that poor EDR.

VI. 🔧 Writing an EDR Killer (45 min) — Aaron

Goal: Create your own killer using BYOVD (Bring Your Own Vulnerable Driver)

• 🔍 Walkthrough:
• Analyze & edit pre-provided code snippets
• Live code augmentation
• Compile & test
• 💀 Use custom code to destroy OpenEDR
• 🔬 Discussion:
• Readily-available tools vs. DIY bypasses

VII. 🤫 Writing an EDR Silencer (45 min) — Aaron

Goal: Quiet the EDR via code — not commands.

• 🧠 Strategy:
• Use API calls to avoid detection
• Replace LOLBins with low-noise native methods
• 🛠️ Live lab:
• Modify and compile silencer code
• Test against OpenEDR agent
• 🧩 Takeaways:
• Code-level silencing = longer dwell time

VIII. 🎤 Wrap-Up (15 min) — Aaron

• 💬 Open discussion & Q&A
• 🧭 What’s next for Aaron & Ryan
• 👋 Goodbyes & DEFCON love
• 💀 #RansomwareSucks stickers and war stories encouraged