Blinding Lights : Modern EDR Disruption Techniques

As enterprise environments evolve and Endpoint Detection and Response (EDR) platforms become a common norm, it becomes important for red team operators to understand not just how these products detect malicious activity, but also how their visibility and response mechanisms work and can be disrupted. This workshop dives into the concept of EDR disruption from an offensive perspective, showcasing how an attacker may attempt to interfere with EDR components to maintain operational stealth.

 

Participants will explore several categories of EDR disruption, starting with the network layer, where Windows Filtering Platform rules are used to block or suppress the telemetry that EDR tools rely on. From there, participants explore how EDR processes can be throttled, frozen, or hindered during critical moments like startup. By the end of this workshop, attendees will understand how each disruption technique degrades defender visibility and how these techniques can be chained together in real-world attacks.