With EDR (Extended Detection and Response) becoming more necessary and common, it begs the question of what tactics and techniques are evading these protections. ProCircular recently conducted a penetration test involving evasion methods that did just that by successfully bypassing EDR protections by leveraging lay-of-the-land tools and incident response techniques. Our objective was to achieve full domain compromise within the targeted network, demonstrating the vulnerabilities and potential weaknesses that need to be addressed for robust cybersecurity. A walkthrough of the attack can be examined below.

As businesses evolve to achieve higher security maturity, threat actors and penetration testers must also rise to the challenge. Modern third-party security applications such as Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), Windows Defender products, and application allowlists have made offensive tools obsolete. Gone are the days when all a penetration tester needed was a remote shell or desktop connection to extract user data and credentials from local machines and domain controllers. Instead of fighting against signature-based and obfuscation methods, attackers are turning to digital forensics incident response (DFIR) tools, like KAPE, to get the dirty work done for them. After all, you never have to sneak into the party if the bouncer thinks you’re already on the list.

When you hear the term "ethical hacker," what comes to mind? Does the word "hacker" make you shudder, or do you see it as an essential part of your cybersecurity strategy?  

It’s hard to believe that we survived 2024, and with 2025 finally here, we thought we would present where ProCircular sees the world headed. The cybersecurity landscape continues to evolve at a breakneck pace, driven by AI-enabled threats and an increasingly complex world. From deepfake videos to targeted social engineering, attackers are finding new ways to exploit trust and access critical systems. 

Hackers have used red team tool EDRSilencer to make the Windows Filtering Platform (WFP) block a list of EDR products from communicating with their management consoles. this software can affect any Windows workstation or Windows server that runs an EDR.