Search papers, labs, and topics across Lattice.
This paper introduces AutoBypass, a multi-agent framework that automates the assessment of Endpoint Detection and Response (EDR) systems by leveraging a structured knowledge base of evasion techniques. The framework effectively orchestrates agents to plan attacks, generate polymorphic code, and adapt strategies based on real-time telemetry feedback. Remarkably, AutoBypass achieved evasion rates of 90% against Windows Defender and 86.7% against Trend Micro AV, significantly improving success rates of open-weight models from 27-53% to 43-83%.
AutoBypass systematically turns fragmented security knowledge into a powerful tool that can consistently bypass leading EDR systems, revealing critical vulnerabilities in commercial security solutions.
Public reports and open-source resources expose many EDR evasion techniques, but it remains unclear whether commercial Endpoint Detection and Response (EDR) systems can withstand these documented attacks. Evaluating them requires turning fragmented security knowledge into working payloads and refining those payloads from opaque alerts, tasks that existing automation does not address. We present AutoBypass, a knowledge-grounded, closed-loop multi-agent framework for automated EDR resilience assessment. A Detection-Aware Knowledge Base structures threat intelligence, expert analyses, and open-source proofs of concept into evasion techniques and operational constraints. Agents use this knowledge to plan attacks, generate polymorphic code, and compile binaries, while a telemetry-driven reasoning engine diagnoses failures and feeds corrective evidence back into the strategy. Across seven commercial endpoint security platforms, AutoBypass bypassed every target, reaching 90% evasion against Windows Defender and 86.7% against Trend Micro AV. Ablations show that the knowledge base raises the success rates of 8B open-weight models from 27--53% to 43--83%, bringing them close to large proprietary models. These results demonstrate a systematic way to operationalize public security knowledge for continuous, automated assessment of EDR resilience.
Tsinghua AI