Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection

A researcher has demonstrated how a locally hosted, uncensored artificial intelligence model can be used to modify a Windows credential-dumping utility, enabling it to bypass two Endpoint Detection and Response (EDR) products in a controlled lab setting. This experiment highlights the potential for accessible generative AI to accelerate the development of custom offensive tools.

The project, led by Project Black researcher Eddie Zhang, focused on targeting the Local Security Authority Subsystem Service (LSASS). LSASS memory often contains authentication material crucial for attackers seeking to achieve lateral movement within a compromised network. The core challenge was to determine if an AI could create an executable capable of dumping LSASS without triggering modern EDR detections, requiring minimal human intervention.

Initial attempts to generate the tool using commercial AI models like Claude Opus and Sonnet resulted in refusals, even with the organization's approval under Anthropic's Cyber Verification Program. The researcher then turned to the open-weight DeepSeek v4 Flash 0731 model. After several prompts, DeepSeek produced a functional executable that could dump LSASS memory, encrypt it, and write it to disk. However, this initial version was still detected by EDR solutions.

To overcome these detection hurdles, Zhang transitioned to an uncensored, community-modified Qwen 3.8 27B model, which was run locally on hardware equipped with two Nvidia RTX 4090 graphics cards. With a simple request to make the executable "more stealthy," the local AI model generated a revised version. This updated tool successfully evaded detection by both EDR platforms in the lab environment.

Analysis of the AI-generated code revealed several modifications that contributed to its stealth. The Qwen model altered process-spawning behavior, reduced the requested access masks against the target process, introduced randomized delays during the dumping process, changed the output filename and path, and removed embedded strings from the binary. These changes are significant as many security defenses rely on detecting recognizable artifacts such as suspicious process ancestry, high-privilege handle requests to LSASS, known strings, and tightly timed execution patterns.

While the findings are significant, their scope is currently limited. The specific EDR vendors were not disclosed, and the exact configuration details were not published. Success in a lab environment against two products does not guarantee universal bypass capability. Nevertheless, the experiment clearly illustrates how local, guardrail-free AI models can iteratively refine existing offensive code without transmitting sensitive prompts or source code to external services.

This development underscores the evolving threat landscape where AI can lower the expertise and time required to create sophisticated, environment-specific malware variants. Defenders are advised to treat EDR as one layer of security rather than an absolute guarantee. Best practices include enabling LSASS credential-stealing Attack Surface Reduction rules with tamper protection, running LSASS as Protected Process Light, deploying Credential Guard, minimizing local administrator privileges, and promptly isolating hosts exhibiting suspicious LSASS access behavior.