Some time ago, I wrote an article about the differences between AV and E/XDR products. I have another good example that shows why AV products are obsolete. In my previous blog post, I described a DNS tunneling technique used for C2 communication. This article shows how the same activity looks from the host detection perspective. The malicious file used on the endpoint is very simple. It is a shortcut file (LNK) that runs PowerShell and invokes a script downloaded from the Internet. This is the beginning of malicious behavior, as shown below. Why is an AV product (Microsoft Defender as an example) unable to trigger any detection here? First, from the endpoint perspective, this technique is classified as LOTL (Living Off The Land). Operating system features are abused for malicious purposes, such as PowerShell in this case, so detection should focus on what the scripts actually do rather than on the PowerShell binary itself. Second, PowerShell invokes the script directly in memory. Nothing is written to disk. Again, a legacy AV product cannot effectively detect this type of activity.
As you can see, AV and E/XDR products are not comparable. AV products are not able to provide a high level of protection against modern techniques used by threat actors.Unfortunately, around 50% of companies in Poland, and I am not aware of other markets, are still relying only on AV-based endpoint protection.