Top 10 EDR Evasion Techniques

Ransomware operators now plan to blind endpoint detection and response (EDR) before they encrypt anything, and many organisations only find out when the agent stops reporting. In August 2025 Singapore's Cyber Security Agency warned that one EDR killer was being shared across groups including BlackSuit, RansomHub, Medusa, Qilin, DragonForce, Crytox, Lynx and INC. This list explains, from the defender's side, the ten evasion techniques that matter most, the MITRE ATT&CK v20 technique for each, and how to detect and prevent it. It deliberately contains no procedures or tooling. It is for SOC leads, detection engineers and endpoint owners who want to test whether their EDR would survive a determined intruder.

The Top 10 at a glance

The table lists ten common ways attackers try to blind or bypass endpoint detection and response, with the first defensive control for each. Each technique is explained below from the defender's side, with detection signals and prevention steps.

1. Bring your own vulnerable driver (BYOVD)

What attackers try: with administrator rights, they install a legitimately signed but vulnerable driver and use its flaw to run code in the kernel, then terminate EDR processes from below the agent's self-protection. ATT&CK describes BYOVD under T1068 Exploitation for Privilege Escalation. Cisco Talos reported a DeadLock ransomware intrusion in December 2025 that abused a signed antivirus driver (CVE-2024-51324) this way.

Detect and prevent: enable memory integrity (HVCI), which also enforces the Microsoft Vulnerable Driver Blocklist; on Windows 11 the blocklist has been on by default since the 2022 update. Where memory integrity is not possible, add the blocklist to your App Control for Business policy, and turn on the Defender ASR rule "Block abuse of exploited vulnerable signed drivers". Alert on new kernel driver loads and service creation on servers, and on any EDR process terminating unexpectedly.

2. Stopping, uninstalling or reconfiguring the agent

What attackers try: the simplest route: stop services, change registry or policy settings, disable real-time and cloud protection, or block the agent's updates. ATT&CK T1685 Disable or Modify Tools covers this. Talos saw the same intruder switch off Defender real-time and cloud protection before encryption.

Detect and prevent: turn on vendor tamper protection centrally, so local changes are refused and raise an alert; require an uninstall token or portal action to remove the agent. Remove standing local administrator rights (ATT&CK mitigation M1026 Privileged Account Management) and restrict registry permissions on agent keys (M1024). Treat "sensor not reporting" as an incident, not an IT ticket. See the Endpoint Privilege Management Guide.

3. Exploiting flaws in the security product

What attackers try: a vulnerability in the EDR, antivirus or management console itself lets them degrade or disable it. ATT&CK v20 tracks this as T1687 Exploitation for Defense Impairment, part of the new Defense Impairment tactic (TA0112).

Detect and prevent: patch security agents and consoles as fast as internet-facing systems, subscribe to the vendor's security advisories, and keep consoles off the open internet behind phishing-resistant MFA. Monitor agent version drift across the estate.

4. Hiding in exclusions

What attackers try: they read the exclusion list, or add to it, and drop tools into excluded folders or run them under excluded process names (T1564.012 File/Path Exclusions). Microsoft warns that process exclusions also switch off network protection and attack surface reduction for that process.

Detect and prevent: use full paths, never bare file names or whole temporary folders; give every exclusion an owner and review date; protect exclusions with tamper protection; and alert on exclusion changes and on executables appearing in excluded paths. See the EDR Tuning and Exclusions Management Guide.

5. Rebooting into Safe Mode

What attackers try: they set the host to boot into Safe Mode, where third-party security software may not start, and run their payload there (T1688 Safe Mode Boot).

Detect and prevent: enable the ASR rule "Block rebooting machine in Safe Mode" or the equivalent in your EDR, alert on boot configuration changes and unexpected reboots, and confirm with your vendor whether its agent runs in Safe Mode.

6. Blinding sensors and telemetry

What attackers try: instead of killing the agent, they make it deaf: removing user-mode monitoring hooks in their own process, disabling or redirecting Event Tracing for Windows (ETW) providers, blocking the agent's network traffic to its cloud, or interfering with log forwarding. ATT&CK T1685 explicitly includes disabling ETW and disrupting logging pipelines.

Detect and prevent: prefer EDR that relies on kernel callbacks and kernel telemetry rather than only user-mode hooks; alert when a device stays online in the network or identity logs but goes silent in the EDR; and watch for host firewall rules blocking the agent (T1686). The joint Five Eyes living off the land guidance advises auditing attempts to read monitoring configuration or disable monitoring software.

7. Living off the land with trusted binaries

What attackers try: they avoid malware altogether and use built-in, signed system tools such as scripting hosts and management utilities to run code, move and persist (T1218 System Binary Proxy Execution). Untuned EDR may treat these tools as benign.

Detect and prevent: application control with AppLocker or App Control for Business (M1038 Execution Prevention), restricting administrative tools to defined roles, verbose PowerShell and command-line logging, and baselines of normal tool use per role. See the Living off the Land Guide.

8. Process injection and in-memory loading

What attackers try: running code inside a legitimate process (T1055 Process Injection) or loading it directly into memory without writing a file (T1620 Reflective Code Loading), so file scanning sees nothing and activity appears to come from a trusted process.

Detect and prevent: use EDR memory scanning and behavioural detection (M1040 Behavior Prevention on Endpoint), alert on unusual cross-process access, especially to LSASS, and enforce the ASR rule that blocks credential stealing from LSASS together with LSA protection.

9. Masquerading and hijacked execution flow

What attackers try: naming files after system components or placing them in trusted locations (T1036 Masquerading), and placing a malicious library where a signed application will load it (T1574 Hijack Execution Flow).

Detect and prevent: detections on signer and path mismatches (a system binary name outside its normal folder, an unsigned DLL loaded by a signed process), the ASR rule "Block use of copied or impersonated system tools", and write restrictions on application folders (M1022).

10. Legitimate remote access tools and log clearing

What attackers try: installing commercial remote management software to keep access that looks like IT support (T1219 Remote Access Tools), then clearing Windows event logs (T1685.005) or disabling them (T1685.001) to remove the trail.

Detect and prevent: keep an approved list of remote access tools and alert on any other; alert on Security log clearing (event ID 1102) and audit policy changes; forward logs out of band to write-once storage, as the joint living off the land guidance recommends. See the Windows Event Log Guide.

Mapping to MITRE ATT&CK and NIST

Where to start

1. Prove tamper protection is on everywhere: report coverage per device group and alert on every tamper attempt. See the Microsoft Defender for Endpoint Guide.
2. Close the driver route: memory integrity, the vulnerable driver blocklist and the driver ASR rule, tested by hardware model.
3. Remove standing local admin: most of these techniques need it.
4. Clean up exclusions: owner, full path and review date for each.
5. Alert on silence: a device active elsewhere but silent in EDR for more than a set period is treated as an incident.
6. Test it: run vendor-approved simulations of agent tampering and Safe Mode reboots in a lab ring, and keep logs off-host. See the EDR Guide and the EDR Evasion and Defence Guide.

Standards and references

• MITRE ATT&CK: Disable or Modify Tools
• MITRE ATT&CK: Exploitation for Privilege Escalation
• ASD's ACSC, CISA, NCSC and partners: Identifying and Mitigating Living Off the Land Techniques
• Cyber Security Agency of Singapore: Advisory on New EDR Killer Tool Used by Multiple Ransomware Groups
• Microsoft Learn: Microsoft recommended driver block rules
• Microsoft Learn: Enable memory integrity
• Microsoft Learn: Protect security settings with tamper protection
• Cisco Talos: New BYOVD loader behind DeadLock ransomware attack

Related NHI Mgmt Group resources: Top 10 Endpoint Security Risks · Ransomware Prevention Guide · Threat Hunting Guide · MITRE ATT&CK Guide for Defenders