AI-Generated EDR Evasion: Detection and Defense Strategies Against Sophos-Identified Threats

---
title: Potential Direct System Call Usage via Stub Execution
id: 8c4e9f12-3a4b-4d5c-9e1f-2a3b4c5d6e7f
status: experimental
description: Detects patterns indicative of dynamic system call resolution (e.g., Halo's Gate/Hell's Gate) often generated by AI to bypass EDR hooks. This looks for processes accessing specific offsets in ntdll.
references:
  - https://attack.mitre.org/techniques/T1014/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1014
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\ntdll.dll'
    GrantedAccess: '0x10' # PROCESS_VM_READ
    SourceImage|contains:
      - '\powershell.exe'
      - '\python.exe'
      - '\cmd.exe'
      - '\wscript.exe'
  condition: selection
falsepositives:
  - Legitimate debugging by developers
level: high
---
title: AMSI Bypass Attempt via Memory Protection Change
id: 9d5f0a23-4b5c-5e6d-0f2a-3b4c5d6e7f8a
status: experimental
description: Detects attempts to modify memory protections of the AMSI DLL (amsi.dll) to RWX, a common technique in AI-generated evasion scripts.
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'VirtualProtect'
      - 'amsi.dll'
    CommandLine|contains:
      - '0x40'
      - 'PAGE_EXECUTE_READWRITE'
  condition: selection
falsepositives:
  - Rare, legitimate system administration tools interacting with memory
level: critical
---
title: PowerShell Reflection Assembly Load
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell loading assemblies from memory or byte arrays, a technique frequently used by AI-generated malware to drop payloads without disk writes.
references:
  - https://attack.mitre.org/techniques/T1620/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1620
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '[Ref].Assembly.Load'
      - 'IEX'
      - 'Invoke-Expression'
  filter:
    CommandLine|contains:
      - 'Exchange-' # Known Exchange management scripts
      - 'LAPS' # Local Admin Password Solution scripts
  condition: selection and not filter
falsepositives:
  - Administrative scripts using reflection for legitimate management
level: medium

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("powershell.exe", "python.exe", "cmd.exe", "cscript.exe", "wscript.exe")
| where ProcessCommandLine has_all ("VirtualProtect", "0x40") // PAGE_EXECUTE_READWRITE
| or ProcessCommandLine has_all ("amsi", "dll")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for suspicious modules loaded into critical processes
SELECT 
  Pid, 
  Name as ProcessName, 
  Username, 
  Mod.Name as ModuleName, 
  Mod.Path as ModulePath,
  Mod.Company as ModuleCompany
FROM process(pslist=TRUE)
SELECT * FROM foreach(row=
  {
    SELECT Name, Path, Company, ModTime
    FROM process_modules(pid=Pid)
    WHERE Name =~ "amsi.dll" OR Name =~ "ntdll.dll"
      AND (Signed == FALSE OR IsSigned == FALSE)
  }
)
WHERE ModuleCompany != "Microsoft Corporation"

<#
.SYNOPSIS
    Audit system defenses against AI-generated EDR evasion.
.DESCRIPTION
    Checks for the presence of AMSI, verifies EDR tamper protection status,
    and hunts for suspicious memory manipulation attempts in Event Logs.
#>

Write-Host "[+] Starting Defense Audit..." -ForegroundColor Cyan

# 1. Check AMSI Providers Status
Write-Host "[+] Checking AMSI Providers..." -ForegroundColor Cyan
$amsiProviders = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\AMSI\Providers"
if ($amsiProviders) {
    foreach ($provider in $amsiProviders) {
        $name = (Get-ItemProperty -Path $provider.PSPath -ErrorAction SilentlyContinue).Default
        if ($name) { Write-Host "    Found Provider: $name" -ForegroundColor Green }
    }
} else {
    Write-Host "    [WARNING] No AMSI Providers found!" -ForegroundColor Red
}

# 2. Check Windows Defender Tamper Protection (Registry Check)
Write-Host "[+] Checking Tamper Protection Status..." -ForegroundColor Cyan
$tamperPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features"
$tamperStatus = (Get-ItemProperty -Path $tamperPath -ErrorAction SilentlyContinue).TamperProtection
if ($tamperStatus -eq 5) {
    Write-Host "    Tamper Protection: Enabled" -ForegroundColor Green
} else {
    Write-Host "    [WARNING] Tamper Protection is not enabled or detected." -ForegroundColor Red
}

# 3. Hunt for recent suspicious process creation (Basic Event Log Check)
Write-Host "[+] Checking recent Security Event Logs for RWX memory requests..." -ForegroundColor Cyan
$events = Get-WinEvent -LogName Security -MaxEvents 100 -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match "VirtualProtect" -and $_.Message -match "0x40" }

if ($events) {
    Write-Host "    [ALERT] Found potential RWX memory manipulation events:" -ForegroundColor Red
    $events | Select-Object TimeCreated, Id, Message | Format-List
} else {
    Write-Host "    No suspicious memory manipulation events found in recent logs." -ForegroundColor Green
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan