Threat Actors Use AI to Automate EDR Evasion Testing, Sophos Research Reveals

Summary

Sophos X-Ops researchers discovered an unidentified threat actor using AI technology to develop EDR evasion tactics through a red team post-exploitation framework. The attack was detected when anomalous endpoint activity triggered alerts for malicious payloads in a customer's test directory. Python scripts were used to test malware against EDR agents from Sophos, CrowdStrike, and Windows Defender, representing a concerning evolution in AI-assisted cyberattacks.

Source

B

bskyThreat Actors Use AI to Automate EDR Evasion Testing, Sophos Research Revealsdarkreading.com