A Short History of EDR

Endpoint detection and response (EDR) was born to compensate for the lack of ability in endpoint protection platforms (EPP) and legacy antivirus (AV) security solutions to prevent every attack. In this post, you’ll learn about the kinds of threats that triggered the birth of EDR, how it came to be, what problems it faces today, and where its future lies.

The threat landscape evolved

During the early 2010s, both defensive security and offensive operations realized how to run malicious code without installing any software—by using an executable to evade both network and legacy antivirus software. There are a few common ways to achieve execution of code without bringing anything that defenders can scan into the infected system. Let’s take a look at two pervasive threats that led to the need for EDR. 

1. Malicious Documents: Phishing Heaven

Many users believe an application can execute code but a file like Microsoft Word, Excel, PowerPoint, or a PDF can’t—it can only be read or written. This isn’t exactly true, but because of the misunderstanding, most users are willing to open a Word document sent by a well-architected phishing campaign. Convincing a user to open what they expect to be a harmless document is much easier than getting someone to double-click an executable they know will run code (although this does happen, too).

Given the widespread perception of document files as harmless containers of content, malware authors soon found easy ways to infect targets through these kinds of files. The most well-known way to run code from documents is by using macros, which were built to automate frequent tasks in documents but are now often weaponized to compromise an end-user’s system. 

Many security-minded people might say, “So, what’s the problem? Just don’t allow macros and you’re safe!” Technically, that’s correct. However, it overlooks two important realities about the way modern enterprises work and how security fits into the business model.

Macro-based malware files are still out there and are successful, in part, because enterprises still use macros to get their work done. They were invented to increase productivity and they do a good job at it. As a result, for many users and businesses, disabling macros is a productivity sacrifice they’re not willing to make. From VBA macros in Excel (used to extract data from other systems or automate calculations) to Word macros (used for inserting a letterhead or creating custom styles and formats), macros have become essential time-saving tools. It’s simply unrealistic for many businesses to block them.

The second reason why infected documents are still out there is because it’s easier for attackers to place them onto devices than, say, a malicious binary or application that could be scanned by a security solution. With just a small amount of personalization, the chances of getting a recipient to open a document from a phishing email increases exponentially. Send someone a CV, payment request, or an invoice, and if you hit the appropriate person such as a recruiter or someone in accounts payable, your chances of getting the “click” might be fairly high (especially compared to sending an executable file).

2. EternalBlue: lateral movement comes to play

Lateral movement techniques are ways attackers spread attacks across a network. These are not new to most sysadmins, but thanks to a leak of NSA hacking tools, it turns out some operating system protocols have had vulnerabilities in them for many years that allow attackers to achieve stealthy lateral movement. One notable example is what we now know as “EternalBlue.”

EternalBlue exploits the server message block (SMB) protocol used for file sharing over the network. This makes the protocol highly attractive to adversaries. EternalBlue was leaked by the Shadow Brokers hacker group in 2017 and was used as part of the WannaCry ransomware attack and NotPetya cyberattack in the same year. Neither AV nor next-generation EPPs could effectively prevent exploitation using EternalBlue at the time.

Fileless malware and system vulnerabilities are just two ways attackers can bypass traditional AV (and also more than a few “next-gen” endpoint solutions). So if your company reputation is on the line and you can’t guarantee protection, what can you do? You find ways to make sure you’re aware of what’s going on with your assets—the new name of the game is detection.

From prevention to detection: EDR is born