The objective of this master's thesis is to evade Endpoint Detection and Response (EDR) systems by exploiting DLL sideloading. The research will commence with identifying and studying various types of DLL-based attacks. The next phase will involve a comprehensive focus on DLL sideloading attack. Subsequently, the thesis will involve implementing traditional DLL based attack and to identify its weakness. The final phase will involve creating an implementation of DLL sideloading attack that will evade Windows Defender. In addition, the thesis will conclude with a discussion on potential countermeasures that could be employed by EDR systems to mitigate the risks posed by DLL sideloading attacks.

Objectives:

1. Conduct a comprehensive review of DLL-based attack methodologies, including DLL sideloading, to understand their relevance to EDR evasion.
2. Implement traditional DLL based attack and point out its inefficiencies.
3. Develop a customised DLL sideloading implementation specifically designed to evade detection by Windows Defender.
4. Suggest countermeasures to the developed sideloading implementation.

Methodology:

The first segment of this thesis will involve conducting an extensive review of DLL-based attack techniques to establish a foundational understanding. It will further include a focus on DLL sideloading attack. The following segment will include examination of a naive implementation of DLL based attack. The final phase will include crafting a DLL sideloading implementation to evade Windows Defender with a discussion on how to counter its evasion.

Expected Outcomes:

1. A comprehensive understanding of DLL-based attack techniques with a focus on DLL sideloading.
2. Critical analysis of an existing DLL based attack implementation, highlighting its limitations in evading detection.
3. Development of a DLL sideloading implementation optimized for evading detection by Windows Defender.
4. Suggested countermeasures to the evasion technique used in the sideloading implementation.