Death by Noise: Abusing Alert Fatigue to Bypass the SOC (EDR Edition)

Death by Noise: Abusing Alert Fatigue to Bypass the SOC (EDR Edition)

Speakers: Rex Guo, Co-founder & CEO, Comminate; Kang (founding security researcher, Comminate)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=Xd4y4hkXprE

Reading Time: ~10 minutes

Type: Briefing

TL;DR

Researchers from Comminate demonstrated that attackers can deliberately suppress or downgrade EDR alerts — not by defeating detection engines, but by exploiting SOC teams' tendency to ignore or suppress medium- and low-severity alerts. Using four mutation principles applied across two realistic attack chains, they achieved full attack execution with zero or near-zero alerts across CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne.

Introduction

Security incidents in enterprises today often succeed not because detection tools fail to fire, but because human analysts lack the capacity to investigate every alert consistently. A typical mid-to-large enterprise receives thousands to tens of thousands of alerts per day, the overwhelming majority of which are false positives or benign positives. SOC teams respond by ignoring low- and medium-severity alerts, conducting shallow investigations, or suppressing noisy rules outright.

Rex Guo and Kang from Comminate — a company building AI-powered SOC agents — turned this observation into an offensive research project: if alerts can be degraded in severity or eliminated entirely through careful technique selection, attackers can operate freely beneath the noise floor. Their talk documents two complete attack chains, the specific mutations applied to evade CrowdStrike Falcon, SentinelOne, and Microsoft Defender, and a framework of four principles that generalize the evasion approach.

The Four Mutation Principles

▶ Watch: Four Evasion Principles Overview (00:02)

Guo and Kang organized their techniques around four generalizable principles, each targeting a different dimension of EDR detection:

1. Footprint reduction — Breaking a monolithic exploit or payload into smaller individual scripts or components changes their signatures completely and reduces the behavioral footprint observable in a single context window.

1. Abstraction — Rewriting the same technique (TTP) in a higher-level language, such as Rust instead of C, bypasses file-based and signature-based detections while the underlying behavior remains identical. The Rust SDK and Rust-based beacons blend in as legitimate code because Rust is increasingly common in enterprise software.

1. Living off the land (LotL) — Leveraging signed, trusted binaries and common enterprise applications (like Slack or other Electron apps) masks attacker activity as legitimate system behavior. The EDR faces a high false-positive cost if it alerts on these processes.

1. Masquerading — Renaming files, changing file paths, and disguising payloads as common utilities (such as copying and renaming bash) causes EDRs to lose context on the attack chain, preventing state-tracking detections from firing.

Attack Chain 1: Linux Server Compromise and Data Exfiltration

▶ Watch: Linux Attack Chain Demo (04:00)

The first scenario simulates a threat actor targeting a cloud-hosted web application. The attack uses CVE-2022-22963, a Spring Cloud Functions vulnerability rated by CISA as one of the most exploited vulnerabilities in the wild. The target web app runs inside a Docker container on a Linux host using cgroupv1, making it vulnerable to a cgroup release agent container escape.

Initial steps: Kang exploited CVE-2022-22963's Spring Expression Language routing function to issue crafted HTTP requests that execute commands on the container. The first iteration downloaded a publicly available statically-linked version of socat from GitHub and copied bash to /dev/shm under renamed aliases.

CrowdStrike Falcon generated alerts at this stage — specifically a "CUR wget malware download" alert and, when the full attack chain ran, a reverse shell detection. Kang's analysis attributed the wget alert to Falcon tracking the specific GitHub download URL as a known threat-actor staging URL.

Mutation applied: Kang replaced the socat/bash approach with a minimal Rust beacon — a simple polling agent that issues a GET request to a C2 server, executes returned commands, and sleeps ten seconds between beacons. Crucially, the beacon was written without obfuscation, because excessive obfuscation increases binary entropy and increases the likelihood of detection.

With the Rust beacon in place, initial access no longer triggered alerts. However, the cgroup release agent container escape exploit still triggered a high-severity Falcon alert when run as part of the attack chain (though it passed silently when tested in isolation). Kang identified this as state-tracking behavior: Falcon associated the escape exploit with the previous suspicious activity.

▶ Watch: Container Escape and Mutation (12:01)

Footprint reduction applied to the escape: The container escape code was refactored from a single script into four smaller scripts — one to set environment variables, one to launch a dummy process and base64-decode a payload, one to mount the cgroup memory controller, and one to trigger the release agent. Individually, these scripts had no malicious signatures. After refactoring, the container escape ran without triggering Falcon.

Persistence and exfiltration: On the host, a cron job provided persistence. For S3 data exfiltration, the researchers wrote a Rust command-line utility using the AWS SDK — a LotL technique that blends in with legitimate cloud operations. The final result: no alerts from Falcon on the complete chain, one suspicious (non-blocking) SentinelOne alert, and zero alerts from Microsoft Defender.

Attack Chain 2: Windows Spear-Phishing and Privilege Escalation

▶ Watch: Windows Attack Chain Intro (20:01)

The second scenario simulates a spear-phishing campaign targeting Windows endpoints, a technique increasingly popular among threat actors who use uncommon file formats like ISO and LNK files to evade initial detection.

Initial access: Kang packaged an LNK file disguised as a PDF (invitation letter.pdf) alongside a document.txt (actually a Windows Script Component .sct file) inside an ISO image. When the user double-clicks the mounted ISO's fake PDF, the LNK file executes regsvr32 with scrobj.dll to run a remote PowerShell script — a classic LotL abuse chain.

Microsoft Defender generated a low-severity "suspicious LNK execution from container" alert (no block). CrowdStrike Falcon generated a medium-severity "PShell download" alert and blocked execution.

Mutation: regsvr32 was too well-known as a LotL vector for EDRs to miss. Kang pivoted to Electron app hijacking. Modern enterprise environments run Slack, Teams, and Notion — all Electron applications that support Node.js native add-ons (.node files, which are standard DLLs). Kang compiled the Rust beacon as a DLL using NAPI (Node API), dropped it into Slack's module directory via the LNK trigger, and waited for Slack to launch and load the beacon.

▶ Watch: Electron App Hijacking Technique (26:02)

The result: zero alerts from Falcon after the Electron hijack replaced the regsvr32 LotL chain.

Privilege escalation: Using Get-WmiObject, Kang enumerated system services and found ITMonitor with an unquoted service path — a common Windows misconfiguration. By placing a malicious it.exe at the expected path location, Windows executed the attacker binary as a privileged service. An it.exe implementation that added a backdoor IAM key and established a reverse shell provided persistence.

Exfiltration: Document files were exfiltrated to an S3 bucket. All three EDRs generated zero alerts on the complete chain after the mutations were applied.

Defensive Analysis

▶ Watch: Defensive Recommendations (30:02)

Rex Guo presented the defensive picture with candor. Custom detection rules can catch these techniques — the release agent escape, unusual process writing to unquoted device paths, or Electron app directories being written by unexpected processes. But these rules generate medium-to-low severity alerts, and their efficacy depends on heavy environment-specific profiling and ongoing tuning.

The core problem is structural: the techniques are designed to push detections toward the lower-severity categories that SOC teams are already overwhelmed by. The only sustainable defense, Guo argued, is automation and AI capable of investigating every credible alert regardless of severity — a conclusion his company's work at DEF CON (demonstrating 12x analyst output improvement with AI augmentation) supports empirically.

Notable Quotes

"Incidents happen in enterprises today not because there's no alert. It's mainly because people don't have time to perform consistent and high-quality security investigations."

— Rex Guo ▶ 00:00

"The techniques we use is really trying to push these TTPs towards a direction where the detection needs to come up with something specific and also it blends in, so the efficacy is actually low."

— Rex Guo ▶ 18:01

"Using too much obfuscation can actually increase the likelihood of your binary being detected."

— Kang ▶ 10:01

"In order to actually fully close the gap, the SOC team cannot just ignore medium-low severity alerts."

— Rex Guo ▶ 32:02

Key Takeaways

• Alert fatigue is an attack surface. Techniques that deliberately generate only low- and medium-severity alerts — or no alerts — can allow complete attack chains to execute undetected against enterprise EDRs.
• Footprint reduction is highly effective. Splitting monolithic exploit scripts into multiple small scripts changes signatures and reduces the contextual footprint that state-tracking EDRs rely on.
• Rust-based tooling evades detection better than obfuscated C/C++. Abstraction through higher-level languages is more effective than obfuscation, which raises entropy scores and invites scrutiny.
• Electron apps are an underappreciated LotL vector. Nearly every enterprise endpoint runs Slack, Teams, or similar Electron apps, making .node DLL injection a stealthy persistence mechanism.
• Defense requires automation at scale. SOC teams cannot manually triage all medium- and low-severity alerts; AI-augmented investigation workflows are necessary to close the coverage gap these techniques exploit.

Slides were not listed as available for this briefing.