arXiv CSopen access

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration Weifeng Yuan∗

Wenbo Guo∗

Qingyun Du

Huazhong University of Science and Technology Wuhan, China [email protected]

Nanyang Technological University Singapore [email protected]

Huazhong University of Science and Technology Wuhan, China [email protected]

Jun Chen

Feng Dong✉

Haoyu Wang

Huazhong University of Science and Technology Wuhan, China [email protected]

Huazhong University of Science and Technology Wuhan, China [email protected]

Huazhong University of Science and Technology Wuhan, China [email protected]

arXiv:2608.01639v1 [cs.CR] 3 Aug 2026

Yang Liu Nanyang Technological University Singapore [email protected]

Abstract

CCS Concepts

While a wealth of evasion tactics is constantly released via threat intelligence, open-source repositories, and security blogs, a fundamental question remains: are state-of-the-art Endpoint Detection and Response (EDR) solutions actually resilient against publicly documented attack vectors? Rigorously answering this requires translating scattered security knowledge into operational payloads. However, the security field currently lacks a systematic approach to autonomously synthesize isolated tactics into functional executables, and the lack of transparency in EDR alerts prevents effective, automated payload refinement. Consequently, end-to-end automation of EDR resilience assessment remains a significant challenge. To bridge this gap, we propose AutoBypass, a novel framework that formulates EDR bypass generation as an autonomous, knowledgegrounded, and closed-loop multi-agent workflow. At its core, a Detection-Aware Knowledge Base (KB) processes raw threat intelligence, expert analyses, and open-source PoCs, converting them into a structured taxonomy of evasion methodologies and operational security constraints to anchor agentic reasoning. Leveraging the KB, a collaborative multi-agent architecture orchestrates high-level attack planning, polymorphic code generation, and binary compilation. Concurrently, a telemetry-driven alert reasoning engine diagnoses the underlying causes of execution failures, supplying actionable feedback to continuously evolve the evasion strategy. In a comprehensive evaluation against seven prominent commercial endpoint security platforms, AutoBypass successfully bypassed all targets, demonstrating peak evasion rates of 90% against Windows Defender and 86.7% against Trend Micro AV. Extensive ablation experiments highlight the critical role of the KB, which empowers smaller, open-weight language models (8B parameters) to improve their evasion success from a baseline of 27-53% to 43-83%, achieving performance parity with massive proprietary models.

• Security and privacy → Intrusion detection systems; Malware and its mitigation; Operating systems security.

1

Introduction

A single successful EDR evasion grants attackers persistent, invisible access to an entire enterprise network, enabling lateral movement, data exfiltration, and long-term control while remaining undetected by the security operations center [50, 62]. Yet the security community continuously publishes techniques probing the limits of EDR defenses. Threat intelligence reports detail evasion techniques, proof of concept repositories demonstrate working exploits, and technical blogs dissect the internals of commercial defenses. This creates a fundamental tension, as the knowledge required for EDR evasion is openly available, but whether modern defenses can truly withstand these published techniques remains an open question. Answering this question requires understanding the multi-layered nature of modern EDR defenses. Today’s systems extend far beyond traditional signature matching, integrating kernel-level telemetry, memory scanning, and cloud-assisted behavioral profiling into a defense-in-depth architecture that scrutinizes every stage of the attack lifecycle [3, 15, 26, 33, 46, 54, 63]. For an adversary, this means that successful evasion now demands simultaneously evading static analysis of on-disk artifacts, behavioral monitoring of runtime execution, and heuristic inspection of memory patterns [9, 14, 31, 37]. Evasion has thus transformed from a static packaging task into a dynamic, multi-dimensional orchestration problem. An attack must not only appear benign on disk, but also behave legitimately in memory and across the network. Given this multi-dimensional challenge, can existing approaches provide a scalable solution? Manual techniques such as indirect system calls to bypass API hooks [35] or repurposing EDR infrastructure for offensive operations [2] have proven effective against

∗ Both authors contributed equally to this research.

1

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

specific targets, but they remain static and labor-intensive, requiring significant expertise to adapt to vendor updates. Automated approaches fare no better. Template-based frameworks like BOAZ [59] and Inceptor [38] produce samples with recognizable fingerprints that EDRs quickly learn to detect, while domain-specific research like ANIMAGUS [68] targets only ransomware behaviors without addressing generic payload delivery (Gap 1: Lack of Polymorphic Generation). Syntactic transformation methods, such as deterministic AST mutations [40], can evade static signatures but cannot strategically pivot between offensive tradecrafts (e.g., switching from process injection to threadless execution) when behavioral monitoring blocks the original approach (Gap 2: No Semantic-Level Adaptation). Furthermore, recent LLM-based tools function as passive coding assistants rather than autonomous agents [4, 5, 16, 24], and to our knowledge all existing methods operate in an open-loop manner: they lack a feedback mechanism to validate payloads against live defenses or interpret opaque EDR alerts, which typically flag a generic threat without disclosing the exact detection root cause. This lack of detail prevents the iterative refinement necessary to converge on successful evasions (Gap 3: Absence of Closed-Loop Feedback). We propose AutoBypass, which addresses these gaps through a knowledge-driven, feedback-directed reasoning process. Our approach centers on three key insights: Addressing Gap 1: To overcome the lack of polymorphic generation, we introduce a multi-agent pipeline that actively randomizes and mixes alternative evasion implementations. It leverages a Detection-Aware Knowledge Base, which distills threat intelligence and defensive rules [23, 55, 66] into structured primitives. Acting as the active orchestrators, our agents intelligently select and compose these components. By dynamically substituting techniques and varying code structures under KB guidance, the multi-agent system breaks away from deterministic templates, achieving reliable polymorphism that raw LLMs cannot accomplish alone [4]. Addressing Gap 2: To achieve semantic-level adaptation, we employ a multi-agent architecture where a Strategist Agent reasons over the KB to select and compose techniques based on detection semantics, not just syntactic patterns. This enables the system to pivot between fundamentally different offensive tradecrafts when one approach is blocked. Addressing Gap 3: To close the feedback loop, a dedicated Tester Agent executes samples in live EDR environments and infers detection root causes by correlating alert timing with observable system telemetry, including process activities, file operations, network traffic and Windows Event Logs [44]. These inferences feed back into the KB to drive iterative strategy evolution. To realize these insights, AutoBypass integrates three core modules: a Detection-Aware Knowledge Base that structures offensive knowledge, a Multi-Agent Sample Generation pipeline that orchestrates strategy selection, code synthesis, and compilation, and an Alert Reasoning module that interprets EDR feedback to drive iterative refinement. We emphasize that the key contribution of AutoBypass lies not in the discovery of fundamentally new evasion primitives, but rather in the autonomous, knowledge-driven orchestration of known techniques to achieve robust polymorphism and semantic adaptation.

We evaluate AutoBypass against seven industry-leading endpoint protection platforms. Our results demonstrate that the framework successfully evades all seven targets, achieving peak evasion rates of 90% against Windows Defender and 86.7% against Trend Micro AV. Ablation studies confirm the KB as the decisive factor, elevating computationally efficient, open-weight models (e.g., Qwen3-8B, Llama-3.1-8B) from a baseline of 27-53% to 43-83% evasion rates and closing the gap with large proprietary models. Furthermore, our analysis reveals that techniques leveraging trusted execution contexts, such as DLL sideloading, are particularly effective against defense-in-depth architectures, as they allow the payload to inherit the benign reputation of the host process. In summary, we make the following contributions: • We introduce AutoBypass, to our knowledge the first framework to model EDR evasion as a knowledge-driven, feedbackdirected agentic process, automating the entire evasion lifecycle from technique selection to iterative refinement. • We design a Detection-Aware Knowledge Base that structures fragmented security knowledge into actionable representations, enabling small open-weight models (8B parameters) to match the performance of large proprietary models. • Through extensive evaluation against seven commercial EDRs, we demonstrate that current defenses remain vulnerable to polymorphic, knowledge-driven attacks, and identify trusted execution contexts as a critical blind spot in behavioral detection.

2 Background 2.1 EDR Detection Mechanisms As shown in Figure 1, modern EDR solutions typically adopt a clientserver architecture [31]. The endpoint agent functions as a sensing array, capturing system telemetry, including process execution, file system operations, and network events. Crucially, these agents operate using a hybrid detection model: they employ local heuristics and static analysis to interdict immediate threats in real-time, while simultaneously transmitting telemetry to a central server for aggregate correlation and retrospective analysis. The agent itself utilizes a modular design composed of specialized sensors, each targeted at monitoring distinct operating system vectors. Client Side

Server Side Endpoint Agent

Operating System (User & Kernel)

Gathers Telemetry

- User-mode Hooks - Kernel Callbacks - Memory Scanner - Static Scanner - ETW Consumer

Sends Telemetry

Cloud Backend - Data Ingestion - ML Analysis - Rule Correlation

Figure 1: Overview of EDR Architecture These sensors collaborate to establish a multi-layered detection method. At the user level, EDRs inject hooks into critical libraries, such as ntdll.dll, to intercept API calls and identify suspicious behavioral patterns like process injection. To ensure visibility even if user-mode hooks are bypassed, EDRs utilize kernel-level callbacks (e.g., PsSetCreateProcessNotifyRoutine) and Event Tracing for 2

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

,,

Windows (ETW) [43]. These mechanisms provide high-fidelity inevolved through a continuous adversarial cycle between attackers formation regarding process, thread, and image loading events. and defenders. Furthermore, to counter fileless threats that reside solely in RAM, To facilitate understanding, Table 1 summarizes the adversarial EDRs employ memory scanners to periodically inspect the address dynamics at each stage, illustrating how evasion techniques have space for anomalies, such as decrypted payloads or evidence of evolved in response to specific detection challenges. reflective DLL loading [48]. This overlapping sensor coverage creates a robust defense-inTable 1: Evasion Techniques Across Loader Stages. depth architecture [32]. Consequently, effective evasion requires an integrated strategy rather than bypassing a single detection mechaStage Detection Challenge Evasion Technique nism. The attacker must coordinate a sequence of actions where Execution Guardrails Sandbox analysis Environment-based decryption every step remains below the detection thresholds of static analyAnti-Emulation Accelerated sleep emulation Computation-heavy delays EDR Desensitization User-mode API hooks ETW patching sis, behavioral monitoring, and memory inspection simultaneously. Memory Allocation RWX memory flagging File-backed DLL overwriting Triggering even a single sensor can initiate correlation logic that Shellcode Injector Thread creation monitoring Process hollowing Shellcode Execution Thread anomaly detection Windows fibers reveals the entire attack chain [30, 47]. Beyond runtime detection, EDRs leverage codified rules for patExecution EDR Shellcode Anti-Emulation tern matching. Static signatures Guardrailsuse YARA [66] to identify mali-Desensitization Input cious byte sequences, while behavioral rules in Sigma [55] and 3 Threat Model Elastic [23] format describe suspicious execution patterns. CompleAttacker’s Goal. Representing a critical post-exploitation phase menting these deterministic rules, Operational Security (OPSEC) Memory Payload where payload delivery dictates the success of an intrusion, the guidelines [34] encode negativePayload constraints (e.g., “avoid RWX mem- Shellcode Allocation Injector Execution Loader adversary aims to execute arbitrary shellcode on a target endpoint ory”) that adversaries must satisfy to remain undetected [41]. without triggering AV/EDR interdiction. Success is defined as the payload completing execution without being blocked or generat2.2 Taxonomy of Evasion Techniques ing high-confidence alerts that would prompt immediate incident To systematically understand EDR evasion, we focus on the shellresponse. code loader because shellcode is universal in offensive operations. Attacker’s Capabilities. We assume the attacker has already Standard C2 frameworks like Cobalt Strike and Sliver [7, 25] generachieved initial access (e.g., via phishing or other means) and holds ate payloads as position-independent shellcode, and mature transstandard user privileges on the compromised system. Within this lation tools such as Donut [58] and sRDI [49] convert arbitrary environment, the adversary is capable of generating and compiling PE files into shellcode format. By targeting the loader that transexecutable artifacts offline within their own infrastructure, and subforms this raw shellcode into an executable state, we address a core sequently deploying the resulting payloads to the target endpoint. delivery mechanism shared across diverse threats. Attacker’s Knowledge. We adopt a gray-box model. The attacker lacks access to the proprietary source code, internal detection logic, or machine learning models of the target AV/EDR. However, Execution EDR Anti-Emulation the attacker can leverage publicly available resources, including Guardrails Desensitization open-source detection rules (e.g., YARA [66], Sigma [55], Elastic rules [23]), technical blogs documenting evasion techniques, and OPSEC guidelines. Additionally, the attacker can observe AV/EDR Memory Shellcode Shellcode feedback (alerts, blocked processes) and iteratively refine their apAllocation Injector Execution proach based on this information. Scope. We focus on the shellcode loader as the attack vector. The system takes arbitrary position independent shellcode as input and Figure 2: Overview of a Shellcode Loader produces an evasive sample designed to execute this shellcode while evading AV/EDR detection. The output can be a standalone exeAs illustrated in Figure 2, the execution lifecycle of a modern cutable or a DLL designed for sideloading [67]. We do not consider shellcode loader is modeled as six stages [19]. This structured clasexploitation of software vulnerabilities (e.g., memory corruption, sification provides a theoretical foundation for systematic evasion zero-day exploits) or attacks targeting the AV/EDR agent itself (e.g., automation. The process initiates with Execution Guardrails, which driver vulnerabilities, privilege escalation to disable AV/EDR). validates environmental criteria to prevent premature execution. The loader then employs Anti-Emulation tactics to delay execution or detect malware sandboxes. Prior to malicious activity, EDR Desensitization attempts to blind sensors. Subsequently, Memory Allocation reserves inconspicuous memory regions while avoiding suspicious permission combinations such as Read-Write-Execute (RWX) mappings that are commonly flagged by EDR systems. The Shellcode Injector writes the decrypted payload into this allocated space. Finally, Shellcode Execution transfers control to the payload. Across these stages, the techniques employed at each phase have

4

System Design

As illustrated in Figure 3, AutoBypass comprises three modules that form a closed-loop system: (1) The Detection-Aware Knowledge Base structures evasion techniques, detection rules, and OPSEC guidelines into a unified representation for agentic reasoning. (2) The Knowledge-Driven Sample Generation module employs a multiagent architecture (Strategist, Coder, Builder, Debugger) to transform strategic plans into compilable executables. (3) The Automated Alert 3

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

Reasoning module executes samples against live EDRs, infers detection root causes, and feeds insights back to refine future iterations.

4.1

agent uses task-specific prompts to extract offensive techniques into formalized JSON tuples and summarize OPSEC guidelines into concise negative constraints. All extracted code snippets undergo manual expert review to ensure compilability and functional correctness. This expert oversight, combined with our strict restriction to highly credible sources, ensures that untrusted data does not compromise the validity of the final outputs. For structured detection rules, we develop Python-based parsers that directly ingest YARA, Sigma, and Elastic rules. To filter redundancy, we leverage directory structures to retain only Windows-specific malware rules and apply keyword filtering on Sigma rules to select those relevant to offensive tradecrafts (e.g., process injection, AMSI bypassing). In our implementation, we collected 1351 web pages through Google Search API using 20 domain-specific keywords, along with 6 GitHub repositories. We employed GPT-4o to filter out off-topic content, reducing the corpus to 427 relevant passages. The LLMbased extraction agent, powered by GPT-5.1, parsed these passages into structured entries. The final KB contains 19 AV/EDR evasion techniques, 5 encoding schemes, 68 OPSEC constraints, and 1537 detection rules (407 YARA, 400 Sigma, 730 Elastic). The hybrid storage is implemented using MySQL for the relational database and Chroma for the vector database, with embeddings generated by the all-MiniLM-L6-v2 model. All extracted code snippets were reviewed by 4 security experts.

Detection-Aware Knowledge Base

General-purpose LLMs are proficient at code generation but lack up-to-date, domain-specific security expertise, often generating unreliable or non-functional code for complex exploit chains [57]. This results in samples that are either functionally unstable or operationally insecure. However, successful autonomous evasion relies on coordinating three categories of critical information: (1) Evasion & Encoding Techniques that define concrete implementation methods for each stage, (2) Defensive Rules that specify OPSEC constraints and behavioral patterns triggering detection, and (3) Historical Experience that records the outcomes and failure causes of past runs. Currently, these sources are fragmented across heterogeneous repositories: evasion techniques are scattered in blogs and PoC repositories, detection rules reside in databases (YARA, Sigma, Elastic), and OPSEC guidelines exist as unstructured advisory documents. Prior work has demonstrated the value of extracting structured knowledge from such unstructured reports for malware detection [29, 41]. We extend this paradigm to the offensive domain. To bridge this gap, we construct a Detection-Aware Knowledge Base (KB) that organizes these three categories into structured, queryable functional modules. We first describe the KB’s construction from heterogeneous sources (§4.1.1), then detail how each category is formally represented (§4.1.2).

4.1.2 Knowledge Organization. To serve diverse query patterns during generation, the KB adopts a hybrid storage architecture. The Strategist requires both structured filtering (e.g., selecting techniques by execution stage and risk level) and semantic retrieval (e.g., finding techniques similar to a given description). The Coder retrieves OPSEC constraints to guide stealthy synthesis and historical records enable learning from past failures. A relational database (RDB) stores structured metadata for precise queries, while a vector database (VDB) stores semantic embeddings for fuzzy retrieval. As detailed in Table 2, this design enables compound queries such as: “Retrieve techniques where Stage is Payload Execution (RDB filter) AND Description is semantically similar to Threadless (VDB similarity).”

4.1.1 Knowledge Base Construction. The core challenge of KB construction lies in transforming security knowledge scattered across heterogeneous sources into a structured, queryable representation. We address this through a three-stage processing pipeline: ① data source identification, ② data collection, and ③ knowledge extraction. ① Data Source Identification. We target two categories of external data sources. For offensive primitives, the relevant sources include technical blogs from security researchers, threat analysis reports from security vendors, and proof of concept repositories on GitHub [10, 11]. For defensive constraints, we target detection rule databases (YARA [66], Sigma [55], Elastic [23]) and OPSEC advisory documents [34]. To locate these sources, we employ the Google Search API with domain-specific terms [28] such as “shellcode loader,” “process injection,” and “EDR bypass.” ② Data Collection. For web pages identified through search, a custom crawler retrieves the HTML content and extracts the main text body, filtering out navigation elements and advertisements. For GitHub repositories, we use the GitHub API to clone the entire project and parse both README documentation and source code files. For detection rule repositories, we directly clone the official repositories, which maintain well-defined directory structures. ③ Knowledge Extraction. The collected raw data requires different extraction strategies based on its structure. For unstructured sources (blogs, reports, OPSEC documents), we employ a two-stage extraction pipeline. First, a lightweight model performs relevance filtering to discard off-topic content and retain only security-relevant passages. Second, an LLM-based extraction agent parses the filtered content into structured knowledge. As shown in Figure 4, the

Table 2: Schema for the Hybrid Knowledge Base Data Evasion & Encode Defensive Rules (OPSEC) History

Storage*

Schema

RDB

id, name, snippet, risk, stage

VDB

embedding ← desc; meta: {id}

RDB

rule_id, type, content

VDB

embedding ← constraint; data: constraint

RDB

run_id, blueprint, result, reason

* RDB: Relational Database, VDB: Vector Database.

Evasion & Encoding Techniques. This component serves as the structured arsenal for sample generation. Each technique 𝑇 is modeled as a formalized tuple:

𝑇 = ⟨Name, Description, CodeSnippet, RiskLevel, StageTag⟩ The RiskLevel (Low/Medium/High) quantifies detection sensitivity, while the StageTag anchors the technique to a specific phase of 4

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

RAW Content Evasion Content Filter Knowledge Extraction

Security Source

Defense History Knowledge Base

Compile

Keywords

Multi-Agent Sample Generation

Generate

Detection-Aware Knowledge Base

,,

Automated Alert Reasoning

Strategist Agent

Attack Blueprint

Coder Agent

Initial Code

Tester Agent iteration Elastic Kaspersky Windows Security EDR Defender VM Test Environment

Test 、Sample

Builder & Debugger

Functionality Check

Knowledge update

Cobalt Strike AdaptixC2 Payload

No Alert

Evasion Sample

Figure 3: System Overview of AutoBypass Historical Experience. This module serves as the system’s longterm memory, archiving iteration data as ⟨Blueprint, Result, Reason⟩ triplets. The Reason field captures the inferred cause of failure (e.g., “Memory Scanning”) derived from alert telemetry. This data drives evolutionary refinement, allowing the Strategist to prune ineffective strategies and pivot to counter-measures in subsequent iterations.

Prompts for Knowledge Extraction Task 1: Offensive Technique Extraction Extract the C++ code snippet for the described injection technique and classify its execution stage. Format the output strictly as a JSON tuple: T=〈Name, Description, CodeSnippet, RiskLevel, StageTag〉 Task 2: OPSEC Constraint Summarization Summarize the following OPSEC advice into a concise constraint (e.g., ‘Do not use API X in context Y’).

4.2

Multi-Agent Sample Generation

This module operationalizes the KB through a multi-agent architecture built upon the LangGraph framework [39]. We decompose the sample generation task into four specialized roles: the Strategist formulates high-level attack plans by querying KB knowledge, the Coder synthesizes polymorphic C++ source code guided by OPSEC constraints, the Builder compiles the source and performs defensive pre-checks, and the Debugger automatically recovers from compilation failures. These agents operate in a sequential pipeline, with the workflow state passed from Strategist to Coder to Builder, and conditionally looping back through Debugger when errors occur.

Figure 4: Prompts used for knowledge construction

the shellcode loader lifecycle (detailed in §2.2). Listing 1 illustrates a concrete entry. Additionally, this category includes encoding schemes (e.g., XOR, AES) paired with decryption stubs to obfuscate static signatures. To ensure generated blueprints are valid and stealthy, we enforce three classes of logic constraints: (1) Intra-stage Exclusivity prevents redundant technique combinations within the same stage; (2) Inter-stage Synergy promotes combinations that collectively reduce detection likelihood; and (3) Environmental Dependencies models preparatory techniques (e.g., DLL Sideloading) as modifiers that can co-exist with other techniques.

4.2.1 Strategist Agent. The Strategist is responsible for synthesizing high-level attack plans that define the architecture of a shellcode loader. Its output is a structured JSON object termed Blueprint, which specifies the evasion technique for each execution stage, the payload encoding scheme, compiler flags, and output format. Table 3 details the blueprint schema.

1 { 2 " Name ": " Fiber Execution " , 3 " Description ": " Executes the payload by converting the current thread to a fiber and scheduling a new fiber that transfers control to the shellcode ." , 4 " CodeSnippet ": " void WINAPI FiberFunction ( PVOID lpParameter ) { ... } ... SwitchToFiber ( payloadFiber ) ;" , 5 " RiskLevel ": " Medium " , 6 " StageTag ": " Shellcode Execution " 7 }

Table 3: Structure of the Blueprint JSON Key Rationale Evasion_tech Encode_tech Compiler_flags Sample_type

Description Explains the strategic reasoning Specifies the evasion techniques Defines the payload obfuscation scheme Sets compiler optimizations Determines the sample format (e.g., exe or dll)

To generate each blueprint, the Strategist queries two knowledge categories from the KB. First, it retrieves Evasion & Encoding Techniques from the relational database, filtering candidates by StageTag to ensure coverage of all execution stages and by RiskLevel to balance stealth against implementation complexity. The agent strictly enforces the logic constraints defined in §4.1.2: intra-stage exclusivity ensures only one technique per stage, inter-stage synergy promotes complementary combinations, and environmental dependencies are correctly modeled.

Listing 1: Fiber-based shellcode execution entry (truncated). Defensive Rules. This category equips agents with defensive awareness and comprises two components. OPSEC Constraints are injected as system prompts to guide the Coder in generating stealthy implementations. Detection Rules (YARA/Sigma/Elastic) are utilized by the Builder to proactively scan generated samples, filtering out binaries that trigger known static signatures or behavioral heuristics before deployment. 5

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

Second, the Strategist leverages Historical Experience to guide iterative refinement. When previous attempts have failed, the agent retrieves the recorded failure causes (e.g., “Memory Scanning”) and performs a semantic search over the vector database to identify relevant countermeasures. For instance, a memory scanning failure prompts retrieval of techniques such as Sleep Obfuscation or Stack Spoofing. This feedback-driven mechanism enables the system to systematically explore the technique space while avoiding previously ineffective combinations. Crucially, rather than executing predefined database lookups, the Strategist employs semantic reasoning to translate opaque failure phenomena into conceptual counter strategies, demonstrating a dynamic decision process that rigid programmatic algorithms cannot replicate.

produces source code, and finally the Builder compiles and validates the output. If compilation fails, the Builder attempts self-repair for up to 5 iterations. If all repair attempts fail, the workflow returns to the Coder with the error context for code regeneration. After 5 consecutive Coder failures, the system falls back to the Strategist for re-planning, assuming the failure is strategic rather than syntactic. Each agent performs a functionally distinct and non-substitutable role. Removing any single agent breaks the pipeline entirely. Figure 5 presents the prompts used for the Strategist and Coder agents. All agents are powered by GPT-5.1 operating at the default temperature to facilitate natural code variance and polymorphism. To strictly ensure output accuracy within this setup, the Strategist outputs are constrained to structured JSON, while the Coder is instructed to produce raw, compilable C++ code without markdown formatting. The Builder integrates with Microsoft Visual Studio Build Tools 2022. It executes vcvars64.bat to configure the MSVC environment and invokes cl.exe for compilation with the flags specified in the blueprint. Each compilation runs in an isolated environment to prevent interference between iterations. All inter-agent communication uses structured outputs (JSON blueprints, C++ source), with comprehensive logging of every iteration to support post-hoc analysis and reproducibility.

4.2.2 Coder Agent. The Coder receives the blueprint from the Strategist and synthesizes fully functional C++ source code. We employ LLM-driven code generation rather than template-based approaches, which naturally introduces polymorphism through variations in variable naming, control flow structure, and code organization, thereby resisting hash-based static detection. To ensure both functional correctness and operational stealth, the Coder queries two knowledge categories from the KB. First, it retrieves the CodeSnippet field from Evasion & Encoding Techniques via exact lookup in the relational database, using the technique names specified in the blueprint. These verified snippets serve as implementation references for complex operations such as indirect syscalls or memory manipulation, reducing the risk of functional errors. Second, the Coder performs a semantic search over OPSEC Constraints in the vector database, using the selected technique names as query keys to retrieve relevant guidelines (e.g., “Avoid RWX memory allocations”). These constraints are injected into the generation prompt to guide the LLM toward stealthy implementations.

4.3

Automated Alert Reasoning

Generated samples are not guaranteed to evade detection on the first attempt, necessitating an iterative refinement process. However, when an EDR blocks a sample, the specific cause is often opaque: alerts may indicate only that a threat was detected, without specifying whether the trigger was a static signature, behavioral heuristic, or memory scan. As illustrated in Table 4, the level of diagnostic detail varies significantly across EDR products. To enable automated iteration, this module performs two tasks: a Tester validates samples in a controlled environment and infers detection root causes from observable system telemetry, while an Evolutionary Update mechanism commits these inferences to the KB’s Historical Experience, enabling the Strategist to refine future blueprints.

4.2.3 Builder and Debugger Agents. The Builder receives the C++ source code from the Coder and produces a compilable executable (EXE or DLL). It invokes the MSVC toolchain with the compiler flags specified in the blueprint. If compilation fails, the Debugger analyzes the error messages and automatically modifies the source code to resolve issues such as missing headers, type mismatches, or syntax errors. This self-repair loop continues until compilation succeeds or a maximum retry limit is reached. After successful compilation, the Builder performs a defensive pre-check using Defensive Rules from the KB. It scans the compiled binary against YARA signatures to detect known malicious byte patterns, and analyzes the source code’s API call sequences against Sigma and Elastic rules to identify behavioral patterns that may trigger runtime detection. Samples matching known signatures are discarded, ensuring only proactively sanitized payloads proceed to the evaluation phase.

Table 4: Variability in EDR Alert Specificity AV/EDR Windows Defender Trend Micro AV Avira McAfee Kaspersky EDR Bitdefender EDR Elastic Security

Process & File Related

Engine Attribution

Rule Detail

Alert Detail Level

✓ ✓ ✓ ✓ ✓ ✓ ✓

× × × × ~ ~ ✓

× × × × × × ~

brief brief brief brief normal normal verbose

Legend: ✓ (Provided), ~(Partial), × (Not Provided). Process & File Related: Identifies the malicious process and file. Engine Attribution: Specifies the detecting component (e.g., static, behavioral, memory, sandbox analysis). Rule Detail: Provides the specific rule content.

4.2.4 Implementation Details. The multi-agent pipeline is implemented using the LangGraph framework [39], which models the workflow as a directed graph with agents as nodes and state transitions as edges. The workflow state is a structured object containing the current blueprint, generated source code, compilation status, and error messages. The pipeline executes sequentially through three stages: the Strategist first generates a blueprint, then the Coder

4.3.1 Tester Agent. The Tester receives the compiled executable from the Builder and produces a structured test result containing the execution outcome and, if detection occurs, the inferred root cause. This agent operates in a two-phase validation process. First, 6

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

,,

Prompts for Generation Agents Strategist Agent “You are an elite Red Team Strategist specializing in EDR evasion. Your task is to formulate the optimal Attack Blueprint for the next iteration based on historical feedback. Capabilities: 1. Failure Analysis: Diagnose the root cause of previous failures using EDR alerts or error logs (e.g., Static Detection vs. Memory Scanning). 2. Knowledge Retrieval: Query the Knowledge Base for compatible ‘evasion_tech’ and ‘encode_tech’ primitives. 3. Evolutionary Logic: Learn from ‘Evaluation History’ to avoid known bad behavior. Decision Logic: - First Run: Prioritize low-risk, high-compatibility primitives. - Subsequent Iteration: If the previous attempt failed, pivot to a counter-strategy (e.g., enable Sleep Obfuscation if Memory Scanning was detected). Output Constraint: Return ONLY the structured ‘Blueprint’ JSON object (rationale, evasion_tech, encode_tech, compiler_flags, sample_type). No markdown, no commentary.” Coder Agent “You are an expert C++ Malware Developer. Your task is to synthesize a high-variance shellcode loader based on the provided Blueprint. Workflow: 1. Retrieve: Fetch verified code snippets for the selected techniques from the Knowledge Base. 2. Constrain: Strictly adhere to the injected OPSEC Constraints: ⟨𝑂𝑃𝑆𝐸𝐶_𝐼 𝑁 𝑆𝐸𝑅𝑇 ⟩ (e.g., “Do not use RWX memory,” “Use Indirect Syscalls for allocation”) 3. Polymorphize: Generate code with high structural variability (e.g., randomized variable names, control flow flattening) to evade static signatures. Hard Requirements: - Output ONLY raw, compilable C++ code (MSVC compatible). - Do NOT use placeholders; ensure all logic is fully implemented. Do NOT include markdown fences or comments.”

Figure 5: Prompts for the Strategist and Coder Agents Table 5: Inference for EDR Alerts

in a baseline environment with the EDR disabled, it verifies that the sample functions correctly (e.g., establishes C2 connection, executes commands). Only samples passing this sanity check proceed to the second phase, where they are deployed against the active EDR to evaluate evasion capability. When a sample is blocked, EDR alerts are often opaque. To enable actionable feedback, the Tester applies heuristic inference by correlating observable system telemetry, including file existence, process lifetime, and network connectivity, to deduce the detection mechanism. As detailed in Table 5, distinct behavioral patterns map to specific root causes: immediate file deletion indicates static signature matching, rapid process termination suggests behavioral blocking, failed C2 connection despite process survival points to network interception, and delayed termination after extended execution implies memory scanning. For instance, if a sample survives initial execution but terminates after several minutes, the Tester infers that memory scanning detected the decrypted payload. This structured inference transforms opaque EDR alerts into actionable feedback that drives the evolutionary update process.

Phenomena Sample is deleted or access denied upon disk write

Alert Reasoning Static Detection: Sample matches known signatures

Process starts successfully but terminates within seconds

Behavioral Blocking: Runtime heuristics flagged the suspicious execution chain

Process remains active but fails to establish C2 connection Process runs for minutes before facing delayed termination

Network Interception: Outbound traffic blocked by firewall or reputation filters Memory Scanning: Periodic scan detected unbacked executable memory

reference templates, biasing the agent toward proven technique combinations. Failed blueprints, paired with their inferred causes, act as negative constraints: the Strategist avoids repeating the same technique selections that previously triggered detection. Furthermore, specific failure causes trigger targeted countermeasures. For instance, a Memory Scanning failure prompts the Strategist to incorporate defensive techniques such as sleep obfuscation or stack spoofing, while a Behavioral Blocking failure leads to pivoting from monitored APIs (e.g., CreateRemoteThread) to less scrutinized alternatives (e.g., NtCreateThreadEx). This feedback-driven mechanism enables the system to systematically explore the evasion space while converging toward effective strategies.

4.3.2 Evolutionary Update. After each test iteration, the Tester commits a structured record to the KB’s Historical Experience. Each record contains the target EDR, the complete blueprint, the test outcome, and for failed attempts, the inferred root cause. This persistent storage enables the system to accumulate operational experience across iterations. The Strategist queries this historical data to close the feedback loop. When generating a new blueprint, it first retrieves records matching the current target EDR. Successful blueprints serve as

4.3.3 Implementation Details. We implement the testing infrastructure using VMware Workstation to manage isolated VMs, with a 7

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

Flask-based web service on the host and a Python agent inside each guest. The agent downloads and executes samples, then monitors system state at 2-second intervals. A successful evasion is defined as the payload establishing a stable C2 connection and maintaining heartbeat communication for over 30 seconds. For failed attempts, the agent infers root causes based on observable phenomena: file deletion within 5 seconds indicates static detection, process termination within 30 seconds suggests behavioral blocking, process survival without C2 connection implies network interception, and termination after 2 minutes points to memory scanning. Historical Experience records are stored in the same MySQL database as the KB, with each record containing target EDR, blueprint, outcome, and inferred cause. The system reverts VMs to clean snapshots after each test to eliminate cached signatures.

5

establishing a stable C2 connection without triggering EDR alerts, or after a maximum of five refinement attempts. For the ablation (RQ2), sensitivity (RQ3), and technique analysis (RQ4), we selected representative subsets of targets to manage computational overhead. Specifically, RQ2 focuses on two distinct tiers of defense, Windows Defender and Kaspersky, while RQ3 and RQ4 evaluate a five target subset consisting of Defender, Trend Micro, Kaspersky, Bitdefender, and Elastic.

5.2

Baseline Selection

We compare AutoBypass against three representative approaches: (1) BOAZ [59], a template-based framework that combines predefined evasion modules; (2) Inceptor [38], another template-based tool that generates shellcode loaders with configurable obfuscation; and (3) Dante-7B [5], a 7B-parameter LLM fine-tuned on malware development data. These baselines represent the current state-ofthe-art in both template-based and LLM-based sample generation. We excluded Leucism [40] as its source code is unavailable, and its AST-based approach operates at the syntactic level without the semantic reasoning required to pivot between offensive tradecrafts.

Evaluation

To demonstrate the efficacy and robustness of our autonomous EDR Evasion framework, we conducted a comprehensive evaluation. Our experiments were designed to answer the following Research Questions (RQs): • RQ1 (Effectiveness): How effective is AutoBypass at evading commercial EDR solutions, and how does it compare to existing approaches? • RQ2 (Ablation Study): What is the contribution of each KB component to the evasion success? • RQ3 (Model Sensitivity): How does performance vary across LLMs of different scales, and can smaller models achieve comparable results with KB support? • RQ4 (Analysis of Evasion Techniques): Which evasion techniques and execution contexts are most effective against modern EDR defenses?

5.3

RQ1: Effectiveness

Table 6 summarizes the evasion success rates, average iteration time, and token cost across all seven targets and three payloads. The results demonstrate that AutoBypass consistently generates evasion samples against a majority of the tested endpoints. Specifically, the framework achieved consistently high success rates against Windows Defender (86.7%–90.0%) and Trend Micro (83.3%–86.7%) across all payload types. Notably, while heavily profiled payloads like Cobalt Strike struggled against Bitdefender (13.3%), our framework effectively adapted when deploying MVP (60.0%) and AdaptixC2 (76.7%), demonstrating the system’s robust capability to generalize 5.1 Experimental Setup across different malware families. Testbed. All experiments were conducted in an isolated environHowever, the system faced consistent challenges across all payment. The host machine runs Windows 11 25H2 and orchestrates loads with Elastic Security (16.7%–23.3%), which employs highly virtual machines through VMware Workstation. The functional aggressive payload execution monitoring. Although Elastic opencheck VM runs Windows 10 22H2 with EDR disabled. To demonsources its behavioral detection rules and YARA signatures, its strate the generalizability of our framework across different envistatic malware prevention engine [21, 22] remains proprietary and ronments, the evaluation VMs were diversified across three distinct unpublished. For Bitdefender, the specific difficulty observed with Windows OS versions. Specifically, Windows Defender AV (Engine: Cobalt Strike stems from its rigorous pre-execution sandbox, which 1.1.25110.1) [45] and TrendMicro PC-cillin AV (17.9.1106) [60] were terminates highly recognizable malicious process creation attempts evaluated on Windows 10 22H2. Avira Internet Security (1.1.115.3317) [6], before our evasion logic can initialize, a constraint largely mitigated McAfee LiveSafe (1.39.160.1) [42], and Kaspersky EDR (12.11.0.637) [36] when using alternative payloads. were deployed on Windows 11 23H2. Finally, Bitdefender GraviTo contextualize our results against existing literature, we comtyZone EDR (7.9.29.589) [8] and Elastic Security (9.2.4) [20] were pared AutoBypass against three baselines. For a fair comparison, we tested on Windows 11 24H2. All security products were evaluated evaluated the widely adopted Cobalt Strike payload across static using default installation settings. template frameworks (BOAZ and Inceptor) and a fine-tuned model Evaluation Protocol. For our primary evaluation (RQ1), we uti(Dante-7B). As shown in Table 7, AutoBypass significantly outperlized GPT-5.1 across three distinct payloads: a standard Cobalt forms all baselines. Template-based tools suffer from deterministic Strike shellcode of 926 bytes to assess evasion of established sigcode patterns that are easily fingerprinted, while Dante-7B, despite natures [13], a custom Minimum Viable Product (MVP) beacon being fine-tuned on malware development data, achieved only a jointly developed with Claude Code (Claude Sonnet 4.5) to 4.7% compilation success rate (14/300 attempts), highlighting the isolate loader effectiveness from known payload patterns, and the difficulty of generating functional exploit code without structured AdaptixC2 framework [51] to confirm generalizability across modknowledge guidance. In contrast, our agentic approach leverages ern threats. For each target, we conducted 30 iterations, where an verified code snippets from the KB to ensure compilability, while iteration terminates upon the first successful evasion, defined as continuously adapting to defensive feedback for robust evasion. 8

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

,,

Table 6: Effectiveness of AutoBypass (with GPT-5.1)

Metric* Success Evasion Avg. Time (min) Avg. Token (In/Out) Success Evasion Avg. Time (min) Avg. Token (In/Out) Success Evasion Avg. Time (min) Avg. Token (In/Out)

Payload Cobalt Strike

MVP

AdaptixC2

W 90.0% 1.29 7.2k/2.3k 86.7% 1.25 8.1k/2.3k 86.7% 1.28 8.2k/2.2k

T 86.7% 1.71 9.5k/3.1k 86.7% 1.58 9.6k/4.2k 83.3% 1.68 10.1k/4.1k

K 53.3% 2.96 15.2k/4.5k 73.3% 1.54 9.7k/3.1k 40.0% 3.02 18.7k/6.6k

A 23.3% 5.85 31.9k/11.4k 60.0% 2.40 13.1k/5.6k 46.7% 2.86 15.5k/5.5k

M 83.3% 1.99 8.6k/2.9k 83.3% 1.49 9.8k/4.1k 86.7% 1.44 9.2k/3.6k

B 13.3% 9.22 70.1k/18.1k 60.0% 2.00 13.3k/5.3k 76.7% 1.52 9.4k/2.8k

E 16.7% 9.40 51.9k/12.7k 23.3% 4.96 32.0k/11.6k 20.0% 6.66 37.1k/14.7k

* W: Windows Defender, T: Trend Micro, K: Kaspersky, A: Avira, M: McAfee, B: Bitdefender, E: Elastic. Evasion rates are evaluated across 30 runs per AV/EDR and payload configuration (𝑁 = 30 per cell). Avg.

Time and Avg. Token represent the average time and token cost per successful evasion.

Table 7: EVASION RATE COMPARISON AGAINST SOTA METHODS AV/EDR*

W

T

K

A

M

B

E

AutoBypass BOAZ Inceptor Dante-7B

90.0% 6.9% 10.0% 7.1%

86.7% 11.3% 30.0% 42.9%

53.3% 0.6% 0.0% 7.1%

23.3% 0.0% 0.0% 7.1%

83.3% 4.4% 16.7% 42.9%

13.3% 0.0% 0.0% 0.0%

16.7% 0.0% 0.0% 0.0%

contrast, all baselines failed to produce any samples within this lowdetection range. Instead, over 50% of BOAZ, Inceptor, and Dante-7B payloads triggered more than 16 engines, with the majority concentrated in the 16–35 detection range. This result confirms that AutoBypass’s knowledge-driven polymorphism significantly outperforms both static templates and prior LLM-based models in generating evasive payloads. The architectural foundation enabling this stealth is the KB. Two security experts independently labeled the top-3 results for all 691 unique queries issued during 5,411 total invocations (8 personhours total), judging whether the returned entries were contextually appropriate for the given query intent. Notably, 82.1% of queries were rated as retrieving at least one relevant result. The remaining misses were overwhelmingly broad exploration queries used by the Strategist for initial surveying rather than precise lookup. For instance, querying “EDR bypass techniques for shellcode execution” surfaces classic_loader as the top result. Even for broad exploration queries without a single exact match, experts consistently rated the returned entries as actionable starting points for semantic orchestration.

* W: Windows Defender, T: Trend Micro, K: Kaspersky, A: Avira, M: McAfee, B: Bitdefender, E: Elastic.

BOAZ (272 generation attempts yielding 159 samples), Inceptor (30 attempts yielding 30 samples) and Dante-7B (300 attempts yielding 14 samples). Evasion rates are calculated based on successfully generated samples, not total generation attempts.

Inceptor

55.1

Dante-7B

36.5

42.9

50

60

26.7

40

20

Table 8: Evasion Rates Upon 1 Month Retest Under Telemetry

Windows Defender Trend Micro AV Avira McAfee Kaspersky EDR Bitdefender EDR Elastic Security

0 0 0

0 0 0

0 0 0

2.2

5.7

7.1

AV/EDR 3.7

17.1

14.1

20 7.8

Percentage of Samples (%)

BOAZ

57.9 53.3

AutoBypass

0 0

1-5

6-15

16-25

26-35

36-50

VirusTotal Detection Count

Figure 6: Comparison of VirusTotal Detection Results

0h (Initial)

1 month

87.8% 85.6% 43.3% 84.4% 55.6% 50.0% 20.0%

76.7% 73.3% 38.9% 83.3% 41.1% 37.8% 18.9%

* Evasion rates are evaluated across (3*30=) 90 runs per AV/EDR (𝑁 = 90 per cell).

Beyond accurate knowledge retrieval, operational stealth also dictates evasion success. Regarding victim process selection, the framework defaults to self-injection, executing the payload within the loader’s own address space to avoid cross-process syscalls that behavioral engines routinely flag. For techniques requiring a fresh host process (e.g., early_bird), the Strategist dynamically spawns notepad.exe as a sacrificial process, selected for its ubiquity and low baseline of anomalous child process patterns.

To conduct a broader assessment, we uploaded all (3*7*30=) 630 samples generated by AutoBypass to VirusTotal and benchmarked them against 159 payloads from BOAZ, 30 from Inceptor, and 14 from Dante-7B [1]. As illustrated in Figure 6, AutoBypass demonstrates superior stealth, with 62.9% of samples triggering five or fewer detections. We adopt ≤5 detections as the evasion threshold following VirusTotal’s own threat hunting guidances [61]. In 9

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

Table 9: Ablation Study Results

While these operational choices yield high initial evasion rates, modern defenses also leverage telemetry analysis. To evaluate delayed detection driven by cloud telemetry, we maintained successful samples on connected hosts and retested them after one month. As shown in Table 8, evasion rates declined over time. We attribute this degradation to two primary factors. First, public sandbox submission accelerates signature generation. Manual testing confirmed that samples uploaded to VirusTotal triggered new detections much faster than those that were never uploaded. Second, endpoint agents automatically transmit suspicious files and behavioral traces to vendor clouds for automated analysis, where these cloud engines can execute and profile the uploaded artifacts to generate new rules.

Config

Model

C-Succ*

Func*

Succ. Evasion

W

Qwen3-8B Llama-3.1-8B

29 29

28 27

83.3% (25/30) 80.0% (24/30)

K

Qwen3-8B Llama-3.1-8B

26 29

26 28

43.3% (13/30) 43.3% (13/30)

W

Qwen3-8B Llama-3.1-8B

27 29

25 23

83.3% (25/30) 76.7% (23/30)

K

Qwen3-8B Llama-3.1-8B

27 29

26 26

43.3% (13/30) 33.3% (10/30)

W

Qwen3-8B Llama-3.1-8B

26 21

22 10

66.7% (20/30) 26.7% (8/30)

K

Qwen3-8B Llama-3.1-8B

27 14

22 9

40.0% (12/30) 30.0% (9/30)

W

Qwen3-8B Llama-3.1-8B

19 24

18 11

60.0% (18/30) 36.7% (11/30)

K

Qwen3-8B Llama-3.1-8B

26 19

24 18

43.3% (13/30) 40.0% (12/30)

W

Qwen3-8B Llama-3.1-8B

27 22

16 10

53.3% (16/30) 33.3% (10/30)

K

Qwen3-8B Llama-3.1-8B

26 23

18 16

36.7% (11/30) 26.7% (8/30)

Full KB

No History

No Evasion Techs

Answer to RQ1: AutoBypass successfully evades all seven targets, achieving success against Windows Defender (90%) and Trend Micro (86.7%), while maintaining superiority over baselines even against aggressive engines like Bitdefender and Elastic. This effectiveness is driven by highly accurate KB retrieval (82.1% top-3 hit rate) and stealthy operational tactics (e.g., leveraging trusted execution contexts), enabling 62.9% of samples to trigger ≤5 VirusTotal alerts. Although cloud telemetry and sandbox submissions degrade evasion rates over a one-month period, the majority of samples remain undetected, proving the temporal robustness of autonomous semantic adaptation.

5.4

AV/EDR*

No Defensive Rules

No KB

* C-Succ: Compilation Success. Func: Functionality Check Passed. W: Windows Defender. K: Kasper-

sky EDR. Each experiment consists of 30 iterations.

Historical Experience drives iterative efficiency. Disabling this component removes the Strategist’s ability to learn from past failures, leading to repetitive, easily detectable behaviors. This is reflected in a drop in success rates, with Llama-3.1-8B’s performance against Windows Defender decreasing from 80% to 76.7%.

RQ2: Ablation Study

To isolate the impact of our architecture from payload variations, we conducted this ablation study utilizing exclusively the standard Cobalt Strike shellcode. We evaluated our framework under five different configurations using two computationally efficient models (Qwen3-8B and Llama-3.1-8B) against Windows Defender (industry standard baseline) and Kaspersky EDR (more aggressive behavioral inspection). This setup demonstrates that our knowledgedriven approach empowers small baselines independent of the advanced reasoning inherent in large proprietary models. The configurations were: (1) Full KB, (2) No History, (3) No Evasion Techs, (4) No Defensive Rules, and (5) No KB (naive LLM baseline without external knowledge). The results, summarized in Table 9, confirm that the KB is the primary driver of evasion success. Removing the KB entirely drops Llama-3.1-8B’s success against Windows Defender from 80% to 33.3%, revealing that LLMs alone lack the domain-specific logic to navigate complex defense engines. Drilling down into individual components, Evasion & Encode Techs are crucial for functional correctness. Removing this module critically impairs the agents’ ability to produce executable code. Notably, for Llama-3.1-8B against Windows Defender, the number of functionally valid samples dropped from 27 to 10, causing the final success rate to fall to just 26.7%. This highlights the KB’s role in grounding LLM synthesis and preventing logical hallucinations. Even when code compiles, Defensive Rules and OPSEC constraints are essential for operational stealth. Without this guidance, agents default to conspicuous implementations, such as allocating RWX memory, which increases the forensic footprint and triggers detection. Consequently, Qwen3-8B’s success rate against Windows Defender fell from 83.3% to 60% when rules were disabled. Finally,

Answer to RQ2: The KB is the decisive factor for evasion success. Without it, both 8B parameter models degrade significantly. Specifically, Llama-3.1-8B drops from 80% to 33.3% against Windows Defender, and Qwen3-8B from 43.3% to 36.7% against Kaspersky. Among KB components, Evasion Techs is paramount for functional correctness, as removing it collapses Llama’s valid samples from 27 to 10, while Defensive Rules ensures operational stealth, evidenced by Qwen3-8B dropping from 83.3% to 60.0% without it. This confirms the KB functions as an intelligence amplifier that elevates small models to practical evasion capability.

5.5

RQ3: Model Sensitivity

Maintaining experimental consistency, we deployed only the Cobalt Strike payload to evaluate framework sensitivity to the underlying LLM. We tested seven models, ranging from large proprietary models (GPT-5.1) to smaller open-weight models (Qwen3-8B, Llama-3.1-8B). Table 10 summarizes the results. Our evaluation yields two key insights. First, although larger models like GPT-5.1 show superior performance and cost efficiency, smaller open-weight models remain effective. For example, DeepSeek-V3 and DeepSeek-R1 achieved over 50% success against multiple targets, proving our framework functions without relying exclusively on state-of-the-art models. Second, the performance gap between large and small models is narrower than in general code generation. Small models like 10

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

Table 10: Model Sensitivity Analysis

,,

Table 11: Effectiveness of Individual Evasion Techniques

Model

AV/EDR*

Succ. Evasion

Avg. Token (In/Out)*

Price ($)*

GPT-5.1

W T K B E

90.0% (27/30) 86.7% (26/30) 53.3% (16/30) 13.3% (4/30) 16.7% (5/30)

7.2k / 2.3k 9.5k / 3.1k 15.2k / 4.5k 70.1k / 18.1k 51.9k / 12.7k

0.032 0.043 0.064 0.269 0.192

DeepSeek-R1

W T K B E

83.3% (25/30) 83.3% (25/30) 56.7% (17/30) 10.0% (3/30) 23.3% (7/30)

13.1k / 10.2k 14.2k / 9.4k 20.9k / 14.3k 139.1k / 75.3k 53.4k / 35.3k

0.032 0.032 0.045 0.271 0.120

DeepSeek-V3

W T K B E

80.0% (24/30) 90.0% (27/30) 53.3% (16/30) 0.0% (0/30) 0.0% (0/30)

12.2k / 1.4k 11.0k / 1.2k 17.7k / 2.2k N/A N/A

0.0058 0.0043 0.0072 N/A N/A

Gemini-2.5-Flash

W T K B E

73.3% (22/30) 66.7% (20/30) 56.7% (17/30) 3.3% (1/30) 6.7% (2/30)

14.0k / 1.6k 14.9k / 1.7k 17.3k / 2.0k 285.7k / 34.1k 158.4k / 17.8k

0.008 0.009 0.010 0.171 0.092

Llama-3.1-70B

W T K B E

66.7% (20/30) 90.0% (27/30) 46.7% (14/30) 0.0% (0/30) 6.7% (2/30)

11.4k / 2.2k 9.6k / 1.9k 17.4k / 3.4k N/A 114.9k / 28.0k

0.002 0.002 0.003 N/A 0.057

Llama-3.1-8B

W T K B E

80.0% (24/30) 80.0% (24/30) 43.3% (13/30) 0.0% (0/30) 0.0% (0/30)

12.3k / 2.3k 14.1k / 2.0k 26.7k / 4.4k N/A N/A

0.0005 0.0005 0.0010 N/A N/A

Qwen3-8B

W T K B E

83.3% (25/30) 80.0% (24/30) 43.3% (13/30) 0.0% (0/30) 0.0% (0/30)

17.8k / 1.2k 20.0k / 1.4k 36.0k / 2.4k N/A N/A

0.0016 0.0018 0.0032 N/A N/A

Technique module_overload remote_thread_hijack fls_callback section_injection threadless classic ekko_sleep etw_patch callback_trigger unhook_ntdll amsi_bypass dirty_vanity queue_user_apc hells_gate register_wait fiber_injection thread_pool uuid_conversion early_bird

E-Fail*

Alert

Succ. Evasion

0 0 0 5 2 0 1 9 0 9 4 1 0 3 3 8 3 0 0

0 4 0 16 15 12 9 27 12 27 20 10 10 17 14 24 24 5 7

9 18 14 84 56 44 67 173 49 139 137 32 33 90 55 108 29 31 33

74.3% (26/35) 62.1% (36/58) 60.0% (21/35) 57.5% (142/247) 56.5% (95/168) 55.6% (70/126) 55.2% (95/172) 54.2% (247/456) 52.0% (66/127) 51.4% (185/360) 51.2% (169/330) 50.6% (44/87) 50.0% (43/86) 49.1% (106/216) 48.9% (69/141) 48.0% (129/269) 47.7% (51/107) 45.5% (30/66) 41.2% (28/68)

* C-Fail: Compilation Failure, E-Fail: Execute Failure.

Our analysis reveals that evasion success is heavily influenced by the technique’s ability to mimic legitimate system behavior. module_overload (74.3%) and remote_thread_hijack (62.1%) demonstrated the highest effectiveness by masking malicious memory as disk-backed sections or abusing less-monitored Fiber Local Storage mechanisms. In contrast, telemetry-blinding techniques like etw_patch and unhook_ntdll incurred the highest alert volumes (173 and 139), indicating that modern EDRs actively monitor the integrity of their own hooks. The results also highlight a trade-off between complexity and reliability: techniques involving runtime memory modification, such as fiber_injection, suffered high execution failure rates (24), while legacy patterns like early_bird (41.2%) have been largely fingerprinted by modern behavioral engines.

* W: Windows Defender, T: Trend Micro, K: Kaspersky, B: Bitdefender, E: Elastic. Avg. Token represents

the average token cost per successful evasion. Prices from https://pricepertoken.com/ (Feb 2, 2026)

Llama-3.1-8B still achieve successful evasion because our KB offloads complex security reasoning. By providing verified snippets, OPSEC constraints, and historical feedback, the KB simplifies the LLM’s task from innovating novel evasion logic to orchestrating preexisting high-quality techniques. However, tradeoffs exist in size, cost, and capability. Smaller models successfully formulate strategies but struggle with tactical implementation, causing more build failures that necessitate Debugger Agent intervention. Conversely, larger models like GPT-5.1 consistently produce compilable C++ code on the first attempt.

Table 12: Evasion Success Rate by Sample Type AV/EDR*

Answer to RQ3: The framework exhibits strong robustness across LLM scales. Against Windows Defender, 8B models (Qwen3-8B: 83.3%, Llama-3.1-8B: 80%) approach GPT-5.1’s 90% at 20 to 60 times lower cost. Unlike typical code generation, our KB simplifies the task to technique orchestration, allowing smaller models to rival SOTA performance. The tradeoff is increased compilation failures requiring more Debugger iterations.

5.6

C-Fail*

W

T

K

B

E

Overall

Standalone EXE

90/117 76.9%

90/109 82.6%

11/98 11.2%

2/104 1.9%

5/102 4.9%

198/530 37.4%

DLL Sideloading

77/93 82.8%

83/101 82.2%

95/112 84.8%

6/106 5.7%

11/108 10.2%

272/520 52.3%

* W: Windows Defender, T: Trend Micro, K: Kaspersky EDR, B: Bitdefender EDR, E: Elastic Security.

As summarized in Table 12, which aggregates all samples generated by the seven models in Table 10, we also observed a clear performance disparity based on the execution context. Techniques that operate within a separate, trusted process, such as those involving DLL Sideloading, consistently demonstrated higher success rates than standalone executables. This is because loading malicious code into a legitimate process’s address space effectively inherits a degree of trust, making the activity appear less anomalous to behavioral heuristics.

RQ4: Analysis of Evasion Techniques

A key advantage of AutoBypass is its ability to systematically evaluate the effectiveness of individual evasion techniques at scale. To achieve this, we aggregate the execution logs from all seven models tested in subsection 5.5. The results, summarized in Table 11, provide a quantitative measure of each technique’s success rate, accounting for compilation failures, execution failures, and EDR alerts. 11

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

alert inference to enable both polymorphic generation and adaptive strategy evolution.

Answer to RQ4: Our analysis of 19 techniques reveals that evasion success depends more on execution context than technical sophistication. DLL Sideloading achieves 52.3% success versus 37.4% for standalone EXEs, as inheriting a legitimate process’s trust evades behavioral heuristics. Among individual techniques, mimicry-based approaches like module_overload achieve up to 74.3% success, outperforming aggressive tampering like etw_patch, which triggers heavy alert volumes (173) due to EDR self-integrity monitoring. Complex techniques (e.g., fiber_injection) suffer execution instability, while legacy patterns like early_bird drop to 41.2% as modern EDRs now recognize these signatures.

6.3

6 Related Work 6.1 EDR Evasion Techniques EDR evasion research spans hook bypass, memory stealth, telemetry blinding, and execution context abuse. At the API interception layer, HookChain [35] redirects execution flow to circumvent usermode hooking. Similarly, indirect syscall techniques directly invoke kernel services to avoid ntdll.dll instrumentation entirely [31]. To counter memory scanning, sleep obfuscation techniques such as Ekko and Cronos encrypt the in-memory beacon image during idle intervals and restore it prior to execution. This approach targets the periodic scan window exploited by EDR memory scanners [19]. Stack spoofing complements these techniques by forging call stack frames to defeat call chain based heuristics. At the telemetry layer, ETW patching and AMSI bypass techniques blind the sensor collection pipeline before payload execution. Beyond technique-level work, EvilEDR [2] demonstrates that EDR agents themselves can be repurposed as offensive tools to fundamentally invert the defenderattacker asymmetry. At a higher level, mimicry attacks [27] embed malicious actions within benign provenance subgraphs. ANIMAGUS [68] also mimics legitimate I/O patterns to evade ransomwarespecific detectors. While individually effective, these techniques address isolated detection vectors and require significant manual expertise to compose across diverse EDR products.

6.2

LLMs for Offensive Security

LLMs have been applied to security tasks including fuzzing and vulnerability discovery. TitanFuzz [18] and Fuzz4All [65] leverage LLMs to generate input programs for fuzzing, while PentestGPT [17] orchestrates LLMs to guide penetration testing workflows. However, these focus on identifying vulnerabilities rather than weaponizing artifacts against active defenses. Furthermore, Sandoval et al. [53] showed unguided LLM code often contains functional defects or triggers immediate detection. Crucially, existing LLM approaches operate open-loop, generating samples without validating against live defenses. AutoBypass closes this gap through a closed-loop architecture where the Tester infers detection root causes from system telemetry, feeding insights back to drive evolutionary strategy refinement.

7

Discussion

Limitations. AutoBypass relies on LLM variability to generate diverse code structures, effectively evading defenses through highlevel strategic iteration. However, it does not yet replicate the finegrained tradecraft employed by human experts. When facing static detection, analysts often use binary splitting (e.g., VirTest) to isolate the exact byte sequence triggering a signature. For behavioral alerts, experts deploy debugging utilities such as x64dbg [64] to pinpoint the specific API call causing the block. Currently, AutoBypass addresses detection failures by regenerating entire modules rather than performing surgical modifications. Future work will introduce a dedicated localization stage to automate these precise refinement tasks. We acknowledge our alert reasoning module relies on heuristic inference. Because commercial endpoint protections emit opaque alerts, our framework deduces root causes empirically by monitoring objective OS artifacts. While highly effective, this cannot guarantee absolute attribution accuracy. Finally, restricting our deployment scope exclusively to shellcode loaders constitutes a notable limitation. Although this focus provides a robust baseline, it omits other prevalent attack vectors, such as script execution environments (PowerShell, WMI). Expanding our orchestration to encompass these diverse vectors remains a critical direction for future research. Generality and Adaptation. A key design goal of AutoBypass is broad generality across diverse endpoint protections with varying alert formats and detection mechanisms. This adaptability stems from two core principles. First, our pipeline possesses autonomous learning capabilities, continuously accumulating successful evasion patterns for each specific target through iterative historical feedback. Second, the evaluation module remains entirely agnostic to proprietary interfaces. It infers evasion outcomes purely by monitoring universal operating system phenomena, such as process survival and network traffic establishment. By relying on objective system states rather than proprietary telemetry, the framework scales across endpoint defenses without manual customization. Implications for Defense. Our evaluation reveals several insights for AV/EDR vendors. First, the high success rates against Windows

Automated Malware Generation

Existing automation approaches span binary mutation, templatebased generation, and LLM-assisted synthesis. At the binary level, AIMED [12] applies genetic programming to mutate malware binaries. MAB-Malware [56] formulates evasion as a multi-armed bandit problem. However, Pierazzi et al. [52] demonstrate that problemspace adversarial examples must preserve file validity and execution semantics. Feature-space perturbations routinely ignore this critical constraint. At the source level, template-based frameworks like BOAZ [59] and Inceptor [38] automate shellcode loader generation by inserting payloads into predefined code skeletons. Their reliance on static structure produces recognizable fingerprints that EDRs quickly learn to detect. Most recently, Dante-7B [5] fine-tunes a 7B model on malware development data. This approach achieves only a 4.7% compilation success rate, underscoring that raw LLM capability without structured domain knowledge is insufficient for reliable exploit synthesis. Critically, all existing approaches operate in an open-loop manner and fail to incorporate live EDR feedback to drive iterative strategy refinement. AutoBypass addresses this gap through semantic-level KB guided reasoning and closed-loop 12

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

Defender (90%) and Trend Micro (86.7%) suggest that signaturebased and basic behavioral detection remain insufficient against polymorphic, knowledge-driven attacks. Second, as demonstrated in RQ4, techniques leveraging trusted execution contexts (e.g., DLL sideloading) consistently achieve higher evasion rates across all tested EDRs. This indicates a systemic blind spot: current defenses struggle to distinguish malicious code executing within legitimate process contexts from benign operations. We recommend that vendors enhance monitoring of code injection into signed binaries and implement stricter validation of DLL loading sequences, even for trusted applications. Responsible Disclosure. We have disclosed our findings and shared representative samples with all seven AV/EDR vendors evaluated in this study. At the time of submission, we have received acknowledgment from two vendors, confirming that our reported samples have been incorporated into their detection pipelines. We will coordinate with the remaining vendors before any public release of technical details.

8

,,

telemetry and detection pipelines against AI evolved threats before such automated methodologies become broadly mainstream. Limited Release Strategy. To further mitigate the risk of direct weaponization while upholding the principles of open science, we have adopted a limited release strategy. We are making the core multi agent orchestration logic publicly available. However, we will strictly withhold the complete pre-populated offensive knowledge base. Instead, to ensure the framework remains fully functional and verifiable for legitimate academic research, we will provide a carefully curated minimal subset containing three of the least effective evasion techniques. This calculated balance allows researchers to validate our methodology and reproduce the workflow without providing unskilled attackers with a ready to use offensive arsenal. Justification for Publication. Ultimately, our decision to publish is driven by the conviction that the current gap in automated EDR evaluation poses a severe risk. While manual evasion techniques are already prevalent in the wild, the security community lacks a scalable method to stress test defenses against them. By introducing this framework and sharing our findings responsibly, we provide a rigorous benchmark for EDR resilience. We believe this controlled disclosure is in the best interest of the public, as it catalyzes the essential hardening of the endpoint security ecosystem against future automated threats.

Conclusion

We presented AutoBypass, to our knowledge the first framework to model EDR evasion as a knowledge-driven, feedback-directed agentic process. By integrating a Detection-Aware Knowledge Base with multi-agent orchestration, our approach achieves 90% and 86.7% evasion rates against Windows Defender and Trend Micro respectively, and our ablation study confirms that the KB elevates small open-weight models to match large proprietary models. Our technique analysis further reveals that trusted execution contexts, such as DLL sideloading, consistently evade modern defenses by inheriting the benign reputation of legitimate processes, exposing a systemic blind spot. Beyond immediate findings, evaluating seven commercial products demonstrates that the knowledge required to evade modern defenses is already public and systematically operationalizable. We hope AutoBypass provides a foundation for continuous endpoint protection evaluation, encouraging vendors to proactively harden identified attack surfaces.

Artifacts To support reproducible research, we have made the core architecture of AutoBypass publicly available. However, due to the sensitive nature of automated bypass and the potential for malicious misuse, we have adopted a limited release strategy. We explicitly acknowledge that withholding the complete pre-populated knowledge base reduces the direct reproducibility of our core claims. Instead, we release the complete multi-agent orchestration logic, testing infrastructure, and a minimal subset containing three of the least effective evasion techniques for academic verification. These artifacts are available in our anonymized repository: https: //anonymous.4open.science/r/bypass-agent-9BE6.

References

Ethical Considerations

[1] Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, Davide Balzarotti, Giovanni Vigna, and Christopher Kruegel. 2020. When malware is packin’heat; limits of machine learning classifiers based on static analysis features. In Network and Distributed System Security Symposium. Internet Society. [2] Kotaiba Alachkar, Dirk Gaastra, Eduardo Barbaro, Michel van Eeten, and Yury Zhauniarovich. 2025. EvilEDR: Repurposing EDR as an Offensive Tool. In 34th USENIX Security Symposium (USENIX Security 25). 587–605. [3] Bushra A Alahmadi, Louise Axon, and Ivan Martinovic. 2022. 99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms. In 31st USENIX Security Symposium (USENIX Security 22). 2783–2800. [4] Anthropic. 2025. Disrupting the first reported AI-orchestrated cyber espionage campaign. https://www.anthropic.com/news/disrupting-AI-espionage, Accessed: Dec 20, 2025. [5] Kyle Avery. 2025. Training Specialist Models: Automating Malware Development. https://blackhat.com/us-25/briefings/schedule/#training-specialist-modelsautomating-malware-development-46238. [6] Avira. [n. d.]. Avira Internet Security. https://www.avira.com/en/internetsecurity, Accessed: Jun 6, 2026. [7] BishopFox. 2026. sliver - Adversary Emulation Framework. https://github.com /BishopFox/sliver, Accessed: Jan 23, 2026. [8] Bitdefender. 2026. GravityZone Endpoint Detection and Response (EDR). https:// www.bitdefender.com/en-us/business/products/endpoint-detection-response, Accessed: Jan 21, 2026.

Stakeholder Analysis. The publication of this framework impacts multiple distinct groups. EDR vendors and enterprise security teams stand to benefit significantly by gaining a realistic benchmark to identify systemic blind spots before they are exploited in the wild. Conversely, enterprise networks and everyday end users face potential negative impacts if threat actors are motivated by our findings to utilize artificial intelligence for malware evolution. We acknowledge the concern that demonstrating these capabilities might accelerate the adversarial adoption of automated evasion techniques. Mitigations and Advance Notification. To ensure the defensive benefits outweigh the potential risks, we implemented strict mitigations. Most crucially, we notified the vendors of all seven analyzed endpoint protection systems well in advance of submission. We provided them with complete reports, inferred root causes, and actionable defensive recommendations. This advance disclosure ensures that defenders have the necessary time to upgrade their 13

,,

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, and Yang Liu

[35] Helvio Carvalho Junior. 2024. HookChain: A new perspective for Bypassing EDR Solutions. arXiv preprint arXiv:2404.16856 (2024). [36] Kaspersky. [n. d.]. Kaspersky Next EDR Expert. https://www.kaspersky.com/en terprise-security/endpoint-detection-response-edr, Accessed: Jan 21, 2026. [37] Kaspersky. 2025. How we trained an ML model to detect DLL hijacking. https: //securelist.com/building-ml-model-to-detect-dll-hijacking/117565/, Accessed: Dec 20, 2025. [38] klezVirus. 2023. inceptor. https://github.com/klezVirus/inceptor, Accessed: Jan 17, 2026. [39] langchain-ai. 2026. langgraph. https://github.com/langchain-ai/langgraph, Accessed: Jan 14, 2026. [40] Andrea Lepori. 2025. Automated Code Transformations to Bypass and Understand Endpoint Detection and Response (EDR) Systems. Master’s thesis. ETH Zurich. [41] Xiaojing Liao, Kan Yuan, XiaoFeng Wang, Zhou Li, Luyi Xing, and Raheem Beyah. 2016. Acing the ioc game: Toward automatic discovery and analysis of open-source cyber threat intelligence. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 755–766. [42] McAfee. [n. d.]. McAfee LiveSafe. https://www.mcafee.com/en-us/antivirus/m cafee-livesafe.html, Accessed: Jun 6, 2026. [43] Microsoft. [n. d.]. Event Tracing for Windows. https://learn.microsoft.com/enus/windows-hardware/test/wpt/event-tracing-for-windows, Accessed: Jan 28, 2026. [44] Microsoft. 2019. Event Viewer. https://learn.microsoft.com/en-us/shows/inside/ event-viewer, Accessed: Jan 23, 2026. [45] Microsoft. 2025. Microsoft Defender Antivirus in Windows. https://learn.micr osoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows, Accessed: Jan 21, 2026. [46] Sadegh M Milajerdi, Birhanu Eshete, Rigel Gjomemo, and VN Venkatakrishnan. 2019. Poirot: Aligning attack behavior with kernel audit records for cyber threat hunting. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security. 1795–1812. [47] Sadegh M Milajerdi, Rigel Gjomemo, Birhanu Eshete, Ramachandran Sekar, and VN Venkatakrishnan. 2019. Holmes: real-time apt detection through correlation of suspicious information flows. In 2019 IEEE symposium on security and privacy (SP). IEEE, 1137–1152. [48] MITRE ATT&CK. 2025. Reflective Code Loading. https://attack.mitre.org/techn iques/T1620/. [49] monoxgas. 2022. sRDI. https://github.com/monoxgas/sRDI. [50] Palo Alto Networks Unit 42. 2024. TA Phone Home: EDR Evasion Testing Reveals Extortion Actor’s Toolkit. https://unit42.paloaltonetworks.com/edr-bypassextortion-attempt-thwarted/, Accessed: Dec 20, 2025. [51] Palo Alto Networks Unit 42. 2025. AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks. Technical Report. https://unit42.paloaltonetwo rks.com/adaptixc2-post-exploitation-framework/, Accessed: Jun 8, 2026. [52] Fabio Pierazzi, Feargus Pendlebury, Jacopo Cortellazzi, and Lorenzo Cavallaro. 2020. Intriguing properties of adversarial ml attacks in the problem space. In 2020 IEEE symposium on security and privacy (SP). IEEE, 1332–1349. [53] Gustavo Sandoval, Hammond Pearce, Teo Nys, Ramesh Karri, Siddharth Garg, and Brendan Dolan-Gavitt. 2023. Lost at c: A user study on the security implications of large language model code assistants. In 32nd USENIX Security Symposium (USENIX Security 23). 2205–2222. [54] SentinelOne. 2025. Decrypting SentinelOne Cloud Detection | The Behavioral AI Engine in Real-Time CWPP. https://www.sentinelone.com/blog/decryptingsentinelone-detection-the-behavioral-ai-engine-in-real-time-cwpp/, Accessed: Dec 20, 2025. [55] SigmaHQ. 2026. sigma. https://github.com/SigmaHQ/sigma. [56] Wei Song, Xuezixiang Li, Sadia Afroz, Deepali Garg, Dmitry Kuznetsov, and Heng Yin. 2022. Mab-malware: A reinforcement learning framework for blackbox generation of adversarial malware. In Proceedings of the 2022 ACM on Asia conference on computer and communications security. 990–1003. [57] Joseph Spracklen, Raveen Wijewickrama, AHM Nazmus Sakib, Anindya Maiti, and Bimal Viswanath. 2025. We have a package for you! a comprehensive analysis of package hallucinations by code generating LLMs. In 34th USENIX Security Symposium (USENIX Security 25). 3687–3706. [58] TheWover. 2024. donut. https://github.com/TheWover/donut. [59] thomasxm. 2025. BOAZ_beta. https://github.com/thomasxm/BOAZ_beta, Accessed: Jan 14, 2026. [60] Trend Micro. [n. d.]. PC-cillin. https://www.trendmicro.com/zh_hk/forHome/tri al.html, Accessed: Jan 21, 2026. [61] VirusTotal. 2022. Threat Hunting with VirusTotal. https://blog.virustotal.com/ 2022/11/threat-hunting-with-virustotal.html, Accessed: Jun 9, 2026. [62] VMRAY. 2024. Advantage Attacker: EDR Bypass Tools | Scarecrow. https: //www.vmray.com/advantage-attacker-edr-bypass-tools-scarecrow/, Accessed: Dec 20, 2025. [63] Qi Wang, Wajih Ul Hassan, Ding Li, Kangkook Jee, Xiao Yu, Kexuan Zou, Junghwan Rhee, Zhengzhang Chen, Wei Cheng, Carl A Gunter, et al. 2020. You are what you do: Hunting stealthy malware via data provenance analysis.. In NDSS.

[9] Bitdefender. 2026. What is DLL Sideloading. https://techzone.bitdefender.com/e n/tech-explainers/what-is-dll-sideloading.html, Accessed: May 20, 2026. [10] calccrypto. 2024. A C++ Encryption Library. https://github.com/calccrypto/Encr yptions. [11] Ibai Castells. 2025. The Evolution of EDR Bypasses: A Historical Timeline. https://www.covertswarm.com/post/timeline-of-edr-bypass-techniques. [12] Raphael Labaca Castro, Corinna Schmitt, and Gabi Dreo. 2019. Aimed: Evolving malware with genetic programming to evade detection. In 2019 18th IEEE international conference on trust, security and privacy in computing and communications/13th ieee international conference on big data science and engineering (TrustCom/BigDataSE). IEEE, 240–247. [13] Cisco Talos - Jonathan Munshaw. 2020. New Snort, ClamAV coverage strikes back against Cobalt Strike. Technical Report. https://blog.talosintelligence.com/cover age-strikes-back-cobalt-strike-paper/, Accessed: Jun 8, 2026. [14] CrowdStrike. 2023. DLL Side-Loading: How to Combat Threat Actor Evasion Techniques. https://www.crowdstrike.com/en-us/blog/dll-side-loading-how-tocombat-threat-actor-evasion-techniques/, Accessed: Dec 20, 2025. [15] CrowdStrike. 2023. Machine Learning (ML) & Cybersecurity How is ML used in Cybersecurity? https://www.crowdstrike.com/en- us/cybersecurity101/artificial-intelligence/machine-learning/, Accessed: Dec 20, 2025. [16] Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Masterkey: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715 (2023). [17] Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, and Stefan Rass. 2024. PentestGPT: Evaluating and harnessing large language models for automated penetration testing. In 33rd USENIX Security Symposium (USENIX Security 24). 847–864. [18] Yinlin Deng, Chunqiu Steven Xia, Haoran Peng, Chenyuan Yang, and Lingming Zhang. 2023. Large language models are zero-shot fuzzers: Fuzzing deep-learning libraries via large language models. In Proceedings of the 32nd ACM SIGSOFT international symposium on software testing and analysis. 423–435. [19] dobin. 2024. The (Anti-)EDR Compendium. https://blog.deeb.ch/posts/how-edrworks/. [20] Elastic. [n. d.]. Detection and response from Elastic Security for Endpoint. https: //www.elastic.co/endpoint-detection-response, Accessed: Jan 21, 2026. [21] Elastic. 2025. Configure an Integration Policy for Elastic Defend. https://ww w.elastic.co/docs/solutions/security/configure-elastic-defend/configure-anintegration-policy-for-elastic-defend Accessed: Jun 9, 2026. [22] Elastic. 2025. Malicious File - Detected - Elastic Defend. https://www.elastic.co /guide/en/security/8.19/malicious-file-detected-elastic-defend.html Accessed: Jun 9, 2026. [23] elastic. 2026. Elastic Security detection content for Endpoint. https://github.com /elastic/protections-artifacts. [24] Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang. 2024. Llm agents can autonomously exploit one-day vulnerabilities. arXiv preprint arXiv:2404.08144 (2024). [25] Fortra. 2025. Cobalt Strike. https://www.cobaltstrike.com/, Accessed: Jan 23, 2026. [26] Gartner. 2019. Market Guide for Endpoint Detection and Response Solutions. https://www.gartner.com/en/documents/3978685, Accessed: Dec 20, 2025. [27] Akul Goyal, Xueyuan Han, Gang Wang, and Adam Bates. 2023. Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems. In 30th Network and Distributed System Security Symposium. [28] Wenbo Guo, Chengwei Liu, Limin Wang, Jiahui Wu, Zhengzi Xu, Cheng Huang, Yong Fang, and Yang Liu. 2024. PackageIntel: Leveraging Large Language Models for Automated Intelligence Extraction in Package Ecosystems. arXiv preprint arXiv:2409.15049 (2024). [29] Wenbo Guo, Shiwen Song, Jiaxun Guo, Zhengzi Xu, Chengwei Liu, Haoran Ou, Mengmeng Ge, and Yang Liu. 2026. Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages. arXiv preprint arXiv:2601.16458 (2026). [30] Xueyuan Han, Thomas Pasquier, Adam Bates, James Mickens, and Margo Seltzer. 2020. Unicorn: Runtime provenance-based detector for advanced persistent threats. arXiv preprint arXiv:2001.01525 (2020). [31] Matt Hand. 2023. Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems. No Starch Press. [32] Wajih Ul Hassan, Adam Bates, and Daniel Marino. 2020. Tactical provenance analysis for endpoint detection and response systems. In 2020 IEEE symposium on security and privacy (SP). IEEE, 1172–1189. [33] Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. 2019. NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019. The Internet Society. https://www.ndss-symposium.org/ndss-paper/nodozecombatting-threat-alert-fatigue-with-automated-provenance-triage/ [34] jermanuts. 2024. Collection of links on bad opsec. https://github.com/jermanuts /bad-opsec. 14

Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

[64] x64dbg. 2026. x64dbg: An open-source user mode debugger for Windows. https: //x64dbg.com/, Accessed: February 3, 2026. [65] Chunqiu Steven Xia, Matteo Paltenghi, Jia Le Tian, Michael Pradel, and Lingming Zhang. 2024. Fuzz4all: Universal fuzzing with large language models. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering. 1–13. [66] Yara-Rules. 2022. Repository of yara rules. https://github.com/Yara-Rules/rules.

,,

[67] Chendong Yu, Yang Xiao, Jie Lu, Yuekang Li, Yeting Li, Lian Li, Yifan Dong, Jian Wang, Jingyi Shi, Defang Bo, et al. 2024. File hijacking vulnerability: The elephant in the room. In Proceedings 2024 Network and Distributed System Security Symposium (2024). https://api. semanticscholar. org/CorpusID, Vol. 267621808. [68] Chijin Zhou, Lihua Guo, Yiwei Hou, Zhenya Ma, Quan Zhang, Mingzhe Wang, Zhe Liu, and Yu Jiang. 2023. Limits of i/o based ransomware detection: An imitation based attack. In 2023 IEEE symposium on security and privacy (SP). IEEE, 2584–2601.

15