EvilEDR: Repurposing EDR as an Offensive Tool

Kotaiba Alachkar, Dirk Gaastra, Eduardo Barbaro, Michel van Eeten, Yury Zhauniarovich

Endpoint Detection and Response (EDR) systems are widely adopted in enterprises for their continuous monitoring, threat detection, and response capabilities, forming a cornerstone of modern security architectures. However, this paper introduces a novel and concerning paradigm: **EDR repurposing**, dubbed **EvilEDR**. Unlike traditional attacks that aim to evade or tamper with EDRs, EvilEDR leverages the legitimate, inherent functionalities of an EDR system itself for offensive purposes. The research demonstrates how an attacker-controlled EDR can be weaponized to execute arbitrary commands, transfer tools, exfiltrate sensitive data, and covertly collect system information, all while masquerading as a trusted security solution.

AI review

Solid offensive research that reframes EDR as attack infrastructure rather than just a bypass target. The MITRE ATT&CK mapping is thorough, the four-vendor evaluation is credible, and the core insight — that trusted security tools make excellent C2 — deserves wider attention. Not a 5 because the concept isn't as novel as they claim (RMM abuse is the obvious parallel), but the systematic treatment and detection rules add real value.