Endpoint Detection and Response (EDR) are software solutions that include real-time anti-malware monitoring, collection and analysis of security data.
It is clear, therefore, that any tool capable of bypassing EDRs is inherently malicious and can potentially compromise the security of the system and pave the way for further stages of the attack.
Specifically, a case study attracted the interest of our Malware Lab. It concerned software presented as the 'EDR Killer', nicknamed 'Terminator' and developed by a user called Spyboy.
A demonstration video showed how it could terminate the process of a well-known endpoint protection software, allowing the execution of a malicious payload that would otherwise have been blocked.
Taking this case study as a starting point, in this week's report we analyse the typical behaviour of EDR Killers and the latest protection techniques.
If you wish to learn more, here is the link to our full report.
In addition, you can subscribe to the specific mailing list Cyber Studios by Tinexta Defence, to receive updates on upcoming research: https://tinextadefence.it/mailing-list-cyber-studios/
