[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVEif1CZsjXASU7-KhEUDcXSH8_yjopvLAqszML-6V0E":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"adba8ca9-9c2f-4bad-839f-830050be75b0","Attackers Use AI to Automate EDR Evasion Testing","attackers-use-ai-to-automate-edr-evasion-testing-39a733","Python scripts were used to test malware against endpoint detection and response agents from Sophos, CrowdStrike, and Windows Defender.","Attackers are leveraging Python scripts with AI capabilities to automatically test malware variants against endpoint detection and response (EDR) solutions from Sophos, CrowdStrike, and Microsoft Defender. This automation enables rapid iteration of evasion techniques to bypass security controls. The development signals a shift toward AI-assisted offensive security operations for malware development and testing.","Attackers automate EDR evasion testing using Python scripts against major endpoint security products.","https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fattackers-automate-edr-evasion-testing","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt016007dbff30c0e1\u002F6a2085be38e0c7c4b455ca45\u002FSophos_offices-Sundry_Photography-getty-1200830219.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-06-03T21:34:07+00:00","2026-06-03T22:00:24.265417+00:00",7,[17,20,22,24,27,30],{"name":18,"type":19},"Sophos","vendor",{"name":21,"type":19},"CrowdStrike",{"name":23,"type":19},"Microsoft",{"name":25,"type":26},"Windows Defender","product",{"name":28,"type":29},"Python","technology",{"name":31,"type":29},"EDR (Endpoint Detection and Response)","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,23,18],{"controls":56,"vendors":138},[57,84,110],{"slug":58,"name":59,"problem":60,"products":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[62,70,77],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":71,"vendor_name":18,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":78,"vendor_name":21,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":85,"name":86,"problem":87,"products":88},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png","arctic-wolf-mdr","Arctic Wolf Managed Detection and Response","https:\u002F\u002Farcticwolf.com\u002Fsolutions\u002Fmanaged-detection-and-response\u002F","24\u002F7 managed detection and response with a named security team.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","rapid7-mdr","Rapid7 MDR","https:\u002F\u002Fwww.rapid7.com\u002Fservices\u002Fmanaged-detection-and-response-mdr\u002F","Managed detection and response, 24\u002F7.",{"vendor_slug":71,"vendor_name":18,"vendor_logo":72,"product_slug":106,"product_name":107,"url":108,"description":109},"sophos-mdr","Sophos MDR","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fservices\u002Fmanaged-detection-and-response","Managed detection and response, 24\u002F7, including for other vendors' tools.",{"slug":47,"name":111,"problem":112,"products":113},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[139,142,146],{"slug":78,"name":21,"logo_path":79,"roles":140},[141],"affected",{"slug":143,"name":23,"logo_path":144,"roles":145},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[141],{"slug":71,"name":18,"logo_path":72,"roles":147},[141],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":159},"ai-powered-edr-evasion-requires-enhanced-detection-strategies","AI-Powered EDR Evasion Requires Enhanced Detection Strategies","Attackers are now using AI-automated Python scripts to rapidly test and refine malware variants against major endpoint detection and response (EDR) solutions, enabling them to systematically bypass security controls. This represents a significant escalation in offensive capabilities, as AI automation allows for faster iteration cycles and more sophisticated evasion techniques than traditional manual methods. Organizations relying solely on signature-based or static detection methods will find their EDR solutions increasingly ineffective against these adaptive, AI-enhanced threats. The shift toward AI-assisted offensive operations means defenders must adopt more dynamic, behavior-based detection approaches and assume their current security controls will be continuously tested and potentially bypassed.",[153,154,155,156,157,158],"CIS Control 8","CIS Control 12","NIST DE.CM-1","NIST DE.AE-2","NIST RS.AN-1","MITRE ATT&CK T1562",{}]