An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors

George Karantzas; Constantinos Patsakis

doi:10.3390/jcp1030021

An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors

Cryptography and Security 2022-01-13 v2

Authors: George Karantzas , Constantinos Patsakis

View on arXiv ↗ PDF ↗ DOI ↗

Abstract

Advanced persistent threats pose a significant challenge for blue teams as they apply various attacks over prolonged periods, impeding event correlation and their detection. In this work, we leverage various diverse attack scenarios to assess the efficacy of EDRs and other endpoint security solutions against detecting and preventing APTs. Our results indicate that there is still a lot of room for improvement as state of the art endpoint security systems fail to prevent and log the bulk of the attacks that are reported in this work. Additionally, we discuss methods to tamper with the telemetry providers of EDRs, allowing an adversary to perform a more stealth attack.

Keywords

advanced persistent threat endpoint detection and response endpoint security attack vectors telemetry tampering blue team empirical assessment

Cite

@article{arxiv.2108.10422,
  title  = {An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors},
  author = {George Karantzas and Constantinos Patsakis},
  journal= {arXiv preprint arXiv:2108.10422},
  year   = {2022}
}

Comments

This is the revised (and final) version of https://doi.org/10.3390/jcp1030021 with more EDRs and proper classification of products into EDRs and EPPs

An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors

Abstract

Keywords

Cite

Comments

Related papers