Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection

A locally hosted, uncensored artificial intelligence model modified a Windows credential-dumping utility until it evaded two Endpoint Detection and Response (EDR) products in a controlled lab, highlighting how accessible generative AI could accelerate custom offensive-tool development. The experiment, published by Project Black researcher Eddie Zhang, targeted the Local Security Authority Subsystem Service (LSASS), whose memory may contain authentication material useful for lateral movement after an attacker obtains administrative access. The project began with a deliberately challenging benchmark: could an AI create an executable capable of dumping LSASS without modern EDR detecting it, while requiring little human direction? This...

Read the full article at the source.