LLM Agents Orchestrate EDR Evasion at Scale

Problem

The paper examines whether commercial Endpoint Detection and Response (EDR) systems can withstand publicly documented evasion techniques when those techniques are systematically combined, automated and refined. Translating fragmented public threat intelligence into operational, polymorphic payloads and diagnosing opaque EDR alerts are open challenges. Without automation that closes the feedback loop, assessing and stressing modern defence-in-depth endpoint products at scale is difficult.

Approach

The authors present AutoBypass, a closed-loop, knowledge-grounded multi-agent framework that automates EDR resilience assessment. A Detection-Aware Knowledge Base (KB) integrates public evasion techniques, encoding schemes, defensive rules and OPSEC constraints into structured entries and historical records. A multi-agent pipeline (Strategist, Coder, Builder, Debugger) synthesises polymorphic C++ loaders from KB-guided blueprints, compiles and pre-scans binaries, and deploys samples to isolated VMs. A Tester agent executes samples against live EDRs, monitors OS telemetry (process lifetime, file events, network connectivity), heuristically infers detection root causes, and records outcomes into the KB to drive iterative strategy evolution. Experiments used GPT-5.1 and several open-weight models, three payload families, and seven commercial endpoint products in isolated VMs with automated rollback between trials.

Key Findings

• AutoBypass successfully bypassed all seven evaluated commercial EDR products in the study, achieving peak evasion rates of 90% against Windows Defender and 86.7% against Trend Micro AV.
• Ablation shows the Detection-Aware KB is decisive: it raises evasion rates of 8B open-weight models from baseline ranges of 27%–53% to 43%–83%, and removing the KB dropped one model's success from 80% to 33.3%.
• Polymorphic, knowledge-driven generation yields high stealth on VirusTotal: 62.9% of AutoBypass samples triggered five or fewer detections, a region where baseline template and prior LLM approaches produced none.
• Technique analysis identifies trusted execution contexts, notably DLL sideloading, as consistently effective because malicious code inherits the host process reputation; some techniques that modify sensor integrity triggered high alert volumes.
• Performance varies by payload and product: Elastic Security exhibited low evasion rates (16.7%–23.3%) due to aggressive execution monitoring, while heavily profiled payloads such as Cobalt Strike were harder to adapt against some engines but AutoBypass improved success when using alternative payloads.

Limitations

The system focuses exclusively on shellcode loaders and assumes initial access with standard user privileges. Alert attribution is heuristic: root-cause inference from opaque EDR alerts uses observed OS artefacts and cannot be guaranteed correct. AutoBypass currently regenerates modules rather than performing fine-grained localisation of signature bytes or single-API fixes. The full offensive KB is withheld from public release for safety, limiting direct reproducibility of exact results.

Implications

Offensively, AutoBypass demonstrates that publicly available knowledge can be operationalised into an automated, closed-loop system that produces polymorphic, adaptive loaders capable of defeating multiple commercial EDRs. An attacker with initial foothold and offline build capabilities could use similar orchestration to iteratively craft payloads that evade static signatures, behavioural monitoring and memory scanners, achieve persistent invisible access, abuse trusted process contexts for higher stealth, and scale attacks across many endpoints with reduced manual expertise.