Ransomware Detection Rates by modern EDRs

TL;DR: EDRs still suck at detecting malicious PowerShell scripts. Sources see github.com/cailllev/VT2

Intro

My project implemented a test framework to boot up a VM, execute a malicious PowerShell script, measure the impact of the script and reset the VM for the next run.

Method

1. Select and develop malicious script types -> account access removal, data destruction, data encryption, data theft and service stop.
2. Select and develop bypass strategies -> rename variables, escape strings, in-memory (IEX), encoded command (enc), file handles and random delays.
3. Build a framework to boot a VM, execute and measure the impact of the script, and reset the VM.
4. Execute tests and note results.

The VT2 Framework

1. start (or reset) the VM
2. check if the service (to run the tests) exists
3. create a clean snapshot (only required once)
4. write the next config to test
5. monitor for a new test run
6. execute the test runner, write true to is-running.txt
7. execute the chosen test
8. check the impact, write the result to res.txt, write false to is-running.txt
9. monitor is-running.txt, get the results when is-running.txt contains false

Results

The columns display the tested scripts (1). The rows display the bypass strategies (2). The numbers indicate how many EDRs blocked the attack, out of 4 tested EDRs.

Results over all EDRs - x out of 4 blocked attacks

Conclusion

Jugding maliciousness for an unknown PowerShell script is nearly impossible. Neiter static nor runtime detections protect systems from silly things happening.