Skip to main content

Who Needs a Pentest: Validating the Configuration of an EDR Solution Using the MITRE ATT&CK Framework

Is that EDR suite fully configured, and providing the expected protection? Do we have a scalable way to test the EDR solution's configuration without requiring a large team or a complete penetration test?

Download file

SANS_A_Fowler_Who_Needs_Pentest (PDF, 2.16MB)

7 Nov 2023
ByAdam Fowler
Share
All papers are copyrighted

No re-posting of papers is permitted

Related Content

passwords.txt: Using Notepad and SmartScreen to Oracle Account Passwords

Research Paper

Enhanced Phishing Protection (EPP) is designed to reduce credential theft by detecting unsafe password entry and providing additional security telemetry within Windows.

  • 20 Oct 2026
  • Derrick Shaw

When DLP Falls Short: Measuring Network Microsegmentation as a Compensating Control for AI Data Exfiltration

Research Paper

Effective protection against AI-assisted data exfiltration requires a combination of advanced content-aware defenses and application-independent network-layer enforcement.

  • 19 Oct 2026
  • Travis Gullickson

Mitigating Multi-Factor Authentication Bypass Attacks: Enforcing Phishing-Resistant Authentication and Workload Identity Controls in Microsoft Entra ID

Research Paper

Modern cloud perimeter security relies on multi-factor authentication (MFA) to safeguard enterprise directories and protect administrative access.

  • 14 Oct 2026
  • Nitin Aggarwal

Contextual Vulnerability Prioritization at Scale: Directing Limited Remediation Resources Through CVSS Environmental Scoring and AI-Assisted Remediation Bundling

Research Paper

The research described in this paper evaluates a pipeline designed to close that gap. It applies CVSS v3.1 Environmental and Temporal attributes to vulnerability findings and recalculates the assigned severity to reflect the true risk a vulnerability poses to the business.

  • 12 Oct 2026
  • Carlos Raygada

Quantifying Agentic Misalignment in Multi-Agent Systems

Research Paper

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data.

  • 1 Oct 2026
  • Vasu Koduru

Invisible by Default: The Polyglot Smuggler

Research Paper

This paper demonstrates a novel data smuggling mechanism: Sub-Channel Steganography. By weaponizing uninspected MP4 subtitle tracks within a structurally compliant ISO base media file, adversaries can encapsulate malicious payloads and exfiltrate sensitive data.

  • 1 Oct 2026
  • John Porpora

Rethinking Full Packet Capture: Evaluating IDS-Triggered PCAP

Research Paper

Enterprise Network Security Monitoring (NSM) solutions generate massive volumes of traffic. However, most organizations cannot sustain full packet capture (PCAP) due to insufficient storage capacity, processing power, and administrative resources.

  • 28 Sep 2026
  • Zachary Gaster

DeScrypt: A Multi-Tool Framework for Automated Unpacking and Analysis of Malicious Scripts

Research Paper

Scripting languages are increasingly dominant malware vectors that often employ layered obfuscation techniques to slow down manual analysis by reverse engineers and to prevent pattern recognition.

  • 28 Sep 2026
  • Daniel Schalla

Evaluating the Impact of Log Configuration on Lateral Movement Detection Using Windows Event Logs

Research Paper

These findings demonstrate that effective endpoint logging depends not only on the amount of telemetry collected but also on the configuration and filtering strategy.

  • 22 Sep 2026
  • Michael Dobbs

Bot or Not? Detecting AI-Driven Web Traffic Using Network Metadata Analysis

Research Paper

This detection method is lightweight, non-intrusive, and easily integrated into existing security toolsets, offering defenders a scalable alternative to traditional bot detection and mitigation techniques.

  • 22 Sep 2026
  • William Hatfield

Continuous Enforcement vs Out-of-Band Validation: Mitigating Configuration Drift on Windows Server 2022 with Automated Remediation Loops

Research Paper

This paper examines the persistent issue of configuration drift within enterprise data centers, where routine administration, patches, and user activity silently degrade established security postures between scheduled audits.

  • 22 Sep 2026
  • Christopher Sandoval

WAFstat: External Verification of WAF Enforcement Posture: Measuring Observable WAF Enforcement Beyond Presence Fingerprinting

Research Paper

This study presents WAFstat, a lightweight external verification method that combines a fixed, versioned marker corpus with response-shape baselines, configuration validation, and immutable provenance.

  • 22 Sep 2026
  • Tiago Kiill

Beyond the Tunnel: A Lab-Based Comparative Evaluation of Network-Layer VPN and Identity-Aware Reverse Proxy Architectures Against the CISA Zero Trust Maturity Model

Research Paper

For the Applications and Data pillars, the results depend primarily on the security features bundled with each product and its platform, and the two architectures converge on Identity because both draw their authentication strength from the same identity provider. The study contributes a repeatable methodology and a scored matrix that shows where the architectures genuinely diverge.

  • 17 Sep 2026
  • Henry Cheung

Assessing the Feasibility and Effectiveness of AI in CTI-Driven Threat Hunting

Research Paper

This study evaluates three commercial LLMs, OpenAI GPT-4o, Google Gemini, and Microsoft Copilot, against ten recent CTI reports, measuring indicator extraction accuracy and validating generated Kusto Query Language (KQL) and CrowdStrike Query Language (CQL) hunting queries in Microsoft Sentinel and CrowdStrike NG-SIEM.

  • 17 Sep 2026
  • Devron West

The Invisible Checkpoint: Passive LTE Traffic Capture for Mobile Malware Detection

Research Paper

This paper presents a privacy-preserving, field-deployable framework for passive mobile malware detection.

  • 11 Aug 2026
  • Garo Sinanian

Evaluating LLMs as a Bridge Between Cyber Threats and Business Risk for Executive Decision-Making

Research Paper

Security leaders cannot act on intelligence they cannot understand, yet most cyber threat intelligence (CTI) reporting is written for analysts, not executives.

  • 11 Aug 2026
  • Arcadio Aguilar

Network Artifacts of Trusted Service Abuse

Research Paper

This study contrasts normal user traffic with known malicious activity to identify alternative indicators from four public C2 frameworks (DaaC2, DBC2, gdog, Callidus) operating on Dropbox, Discord, Gmail, and OneNote, using 51 packet captures (3 baselines, 6 automated browser tests and 6 framework tests per service).

  • 6 Aug 2026
  • Nicholas Vaniscak

Dual-Module QR Codes: Bypassing QR Code Scanners in Enterprise Email Gateways

Research Paper

By exploiting the decoding algorithm and leveraging existing QR data-layering techniques, this research provides the security industry with a working proof-of-concept to bypass email security gateway detection systems.

  • 6 Aug 2026
  • Steven Legere

Entra ID Governance: Insta-IAM/IGA Solution?

Research Paper

This research evaluates the viability of using Entra ID Governance as a primary IAM/IGA solution through a proof-of-concept implementation modeled on a moderately complex organization with multiple systems of record.

  • 6 Aug 2026
  • Scott Fortin

Evaluating the Detection Effectiveness of Network Monitoring Tools Against Modern Command-and-Control Frameworks

Research Paper

This research measures the effectiveness of Zeek, Suricata, and Security Onion against representative modern C2 frameworks in a controlled laboratory environment.

  • 9 Jul 2026
  • Joseph Zderadicka