Bypassing Cylance: Part 4 – Metasploit Meterpreter & PowerShell Empire Agent

This Black Hills InfoSec report documents hands-on testing of Cylance endpoint protection: Metasploit Meterpreter payloads were repeatedly detected and blocked, but renaming the native PowerShell executable allowed a PowerShell Empire agent to execute and establish C2. With default settings the agent was identified after ~3 hours, but after adding jitter and non-default resources the Empire beacon evaded detection for more than 24 hours, illustrating an AV-evasion TTP and the need for defense-in-depth.