Why Alert Volume Defeats Detection

▶ Watch (00:50)

Mid-to-large enterprises receive thousands to tens of thousands of alerts per day. Most are false positives or low-severity noise. SOC teams respond by ignoring medium-low alerts, running shallow investigations, or suppressing the noisy rules entirely.

Rex Guo and Kong tested CrowdStrike Falcon, Microsoft Defender, and SentinelOne. Their goal: take TTPs that generate critical or high alerts and mutate them down to low, medium, or nothing, without touching kernel internals.

Linux Attack Chain: CVE Exploit to Data Exfiltration

▶ Watch (04:04)

Kong exploited CVE-2022-22963 (Spring Cloud Functions) on a Docker container, escaped to the host via cgroup v1 release agent, persisted with a cron job, and exfiltrated S3 data. The initial payload used socat for the reverse shell. Falcon generated a high-severity wget malware download alert and blocked the bash reverse shell outright.

Tested in isolation, the rename-and-relocate trick produced no alert. Run as part of the full attack chain, Falcon flagged it. State tracking ties earlier suspicious activity to subsequent steps, raising the detection bar for the whole sequence.

Evasion Through Abstraction and Footprint Reduction

▶ Watch (09:23)

Kong replaced socat with a minimal Rust beacon written without obfuscation (10:42). Rust’s lightweight runtime changes the binary signature without adding obfuscation overhead. Heavy obfuscation was deliberately avoided: high entropy scoring is itself a detection signal.

“EDRs don’t just look at what you’re doing but also” (Kong)

When the cgroup escape still triggered on the mount step, Kong split the single exploit script into four smaller files. Same logic, different signatures. CrowdStrike’s container escape alert disappeared. The final Linux chain produced zero Falcon alerts, one low-severity SentinelOne indicator (no block), and zero Defender alerts.

Windows Attack Chain: Slack Hijacking for Persistence

▶ Watch (19:38)

The Windows chain started with a fake meeting invite ISO containing an LNK disguised as a PDF. The LNK ran regsvr32.exe with a remote SCT script. Falcon blocked it at medium severity. Kong pivoted: Electron apps load Node.js native extensions (.node files) from module directories, and those paths are trusted by EDRs.

The Rust beacon was compiled to a DLL via Node-API, renamed index.node, then dropped into Slack’s registry-js directory (27:49). When Slack launched, the shell arrived. An unquoted IT Monitor service path completed privilege escalation. All three EDRs produced zero alerts.

Detection Engineering Against Low-Noise Attacks

▶ Watch (31:33)

Four evasion principles emerged: living off the land, footprint reduction (split a large TTP into small sequential chunks), abstraction (rewrite in Rust to change file signatures), and masquerading (rename and relocate binaries). Detection rules exist for each, but they tend to generate medium-low severity alerts, the exact tier SOC teams already suppress.

Closing the gap requires custom detection rules and automation to investigate every medium-low alert. Default EDR configurations across all three products left significant coverage gaps, none of which required kernel exploits to reach.

Notable Quotes

EDRs don’t just look at what you’re doing but also Kong · ▶ 10:08

for living off the land I’ll hijack Slack. Kong · ▶ 26:39

team either start to ignore the medium Rex Guo · ▶ 1:10

Key Takeaways

  • Attackers can downgrade critical EDR alerts to low or none using four principles: living off the land, footprint reduction, abstraction, and masquerading.
  • EDR state tracking detects attack chains that pass clean in isolated tests, so defenders must tune for chained behavior.
  • Custom medium-low severity detection rules are necessary, and SOC teams need automation to investigate every one of them.