Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing EDR with Local AI

projectblack.io | blog | #ai-security | #windows | #penetration-testing | #llm | #post-exploitation | #edr-evasion | #lsass-dump

Summary

A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.
Published
Collected

original ↗

Related coverage

blog · yeswehack.com
Is AI pentesting safe?
YesWeHack examines three key AI pentesting concerns - scope control, harm avoidance, and traceability - and shows how its Agentic Pentest harness addresses them for safe autonomous testing.
blog · specterops.io
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.
blog · projectzero.google
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
How Project Zero evolved Project Naptime into Big Sleep, using large language models to find vulnerabilities in real-world software, with early results and observations.
blog · projectzero.google
Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models
Project Naptime evaluates the offensive security capabilities of large language models, presenting a methodology, tooling setup, and early successes finding real vulnerabilities.
blog · jfrog.com
Integrating Vector Databases with LLMs: A Hands-On Guide
Welcome to our hands-on guide where we dive into the world of Large Language Models (LLMs) and their synergy with Vector Databases. LLMs have been a game-changer in the tech world, driving innovation in application development. However, their full potential is often untapped when used in isolation. This is where Vector Databases step in, enhancing…
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
back