[lucasm]

Hello community,

I tried various methods to bypass edrs and avs. Got success in terms of all the big names there. Just one is creating trouble i.e. Crowdstrike falcon sensor.

The problem is not in dynamic detection, Its pretty smooth. But the problem is in static detection. The detection i am getting is either ML (Machine Learning Based) based or some AI based where it sees and feels like it could be malware.

Obviously the problem is not in CS default config but if the aggressive mode is on, this ML based detection is creating problem.

I wonder if anyone have bypassed that recently or can help/guide me towards it.

[volumehead]

Can you give some more details? Are you using the plain CS binary or packing it?

Often, for machine learning, the following bypasses can help:
- Add good metadata to the file using Metatwin and similar tools.
- If packing, make sure to check the entropy of the file! Use Detect It Easy in advanced mode, you will see a button to view the entropy. This should NOT be higher than 6 bit per byte. Often, Machine Learning just triggers on high entropy, which usually comes from packed payloads. If your entropy is too high, you need to reduce it by modifying your packer.
- Also, again if you're using a custom packer: Add some benign assembly from the .text section of some program (e.g. from VLC or some other popular software) to your executable. This assembly doesn't actually have to be executed at any point, but just it's presence can help make Machine Learning think the whole file is probably fine. Sounds stupid, but it works.

[Sh4d0wS33k3r]

Doesn't CS Falcon Sensor Work by behavioral analysis?,

also there is a github repo that bypass almost all AVs, it does it by using the firewall to block connections to the
AV server, or something like that. can't remember.