Threat Brief: Security Control Bypass Patterns

Scope	Audience	Assessment confidence
Cross-industry / Enterprise	Security leadership, SOC, detection engineering and threat hunting teams	Medium. Based on primary incident-response and advisory sources; one technique rests on a single documented tool.

Bottom line

Attackers rarely beat a security control head-on. They find where the control does not apply, the process that can switch it off, or the credential that makes it irrelevant.

Six bypass patterns recur in current incident reporting. Three go through identity and human process. One disables the endpoint agent. One works where the agent never ran. One targets the systems that recover and manage everything else.

The practical shift: stop asking whether a control is deployed. Ask what an attacker would do to make it irrelevant, and whether you would see it happen.

Key judgments

Voice-led social engineering is now a mainstream route past MFA. Confidence: High. Mandiant reports voice phishing as the second most common initial infection vector in the investigations behind its latest M-Trends report, at 11%, behind exploits at 32% and ahead of email phishing at 6%. CISA and the FBI document help-desk impersonation used to reset passwords and MFA in their Scattered Spider advisory.
Endpoint agents are a deliberate target before ransomware deployment, and the technique relies on administrator rights the attacker already holds. Confidence: Medium. Cisco Talos documented a multi-stage tool used in Qilin ransomware attacks that works through a list of more than 300 EDR drivers. One documented tool does not measure prevalence.
A control that cannot run on a device does not protect it, and attackers are choosing those devices. Confidence: Medium. M-Trends describes espionage clusters working on VPNs, routers and similar appliances that lack EDR telemetry, using in-memory implants that survive reboots.
Recovery and management systems are attacked to bypass resilience. Confidence: Medium. M-Trends reports ransomware operators going after backup infrastructure, identity services and virtualization management planes.
The time to react is collapsing. Confidence: Medium. Mandiant’s median handoff from an initial access provider to a secondary group fell from more than eight hours three years earlier to 22 seconds. Mandiant’s own advice is to treat routine malware alerts as signs of an impending hands-on-keyboard intrusion.

Observed bypass patterns

Each row is a pattern documented in the sources listed below. The “what gets bypassed” column names the control the pattern is built to defeat.

Pattern	What gets bypassed	How it works	Evidence
Help desk and enrollment abuse	MFA and identity proofing	A caller impersonates an employee or IT staff to obtain a password or MFA reset, registers an attacker-controlled MFA method, or adds a federated identity provider to the SSO tenant so logins work whatever happens to the victim’s password. SIM swapping takes over text-message codes.	CISA/FBI Scattered Spider advisory; M-Trends (UNC3944 targets IT help desks)
Prompt fatigue and stolen sessions	MFA	Repeated push prompts until a user approves; one-time codes talked out of users; long-lived OAuth tokens and session cookies harvested. A stolen session carries authentication that has already been completed.	CISA/FBI advisory; M-Trends
EDR killers	Endpoint detection and response	DLL side-loading runs the tool in memory. A signed but vulnerable driver gives kernel-level access. The tool removes EDR callbacks, ends protected processes and suppresses ETW telemetry. It needs administrator rights to start.	Cisco Talos
Devices with no sensor	EDR, host forensics, log-based detection	Intruders work on edge and network devices where EDR is absent. Minimal onboard storage limits forensics. Standard 90-day log retention can hide the entry point in a long intrusion.	M-Trends
Trusted third parties and unprotected credentials	MFA and network restriction	Valid credentials from infostealer logs, some years old, used against data platform accounts with no MFA and no network allow-list, followed by bulk query and export. Compromised SaaS vendors yield hard-coded keys and access tokens that open customer environments.	Mandiant Snowflake analysis; M-Trends
Recovery and management planes	Backup, segmentation, resilience	Backup objects deleted in cloud storage. Hypervisor storage encrypted so every VM fails together. Misconfigured certificate templates used to create admin accounts that sit outside password rotation.	M-Trends

Analysis

Every pattern in the table attacks the assumption underneath a control, not the control itself. MFA assumes the person asking for a reset is the person. EDR assumes the attacker does not control the kernel. Log-based detection assumes the device writes logs. Backups assume the identity plane is separate from production. When the assumption fails, the control keeps reporting healthy. That is why bypass is hard to see.

EDR killers show the sequencing. The Talos tool needs administrator rights, so it is a late step. By the time it runs, the attacker already has privilege and a way to load a driver. The earlier failures are privilege exposure and unmonitored driver loading. Fixing only the endpoint product addresses the last link in the chain.

The 22-second handoff changes the operating model. A SOC that triages alerts in sequence and escalates after review is built for a threat that moves in hours. Where the window is seconds, the controls that matter are the ones that act without waiting: tamper protection, driver blocking, conditional access, automated session revocation, and isolation on high-confidence detections.

What defenders should change first

Rebuild help-desk verification. Use identity proofing that a phone call cannot defeat: call back to a number held in HR records, require manager approval for privileged accounts, and never reset MFA on a voice request alone. Alert on new MFA method registration, new federated identity providers and password resets followed by a sign-in from a new device.
Move privileged and remote-access users to phishing-resistant MFA first. CISA names FIDO/WebAuthn and PKI-based MFA, particularly for webmail, VPNs and critical systems. Number matching and prompt limits reduce fatigue attacks but do not stop session theft. Shorten session lifetimes for privileged roles and revoke tokens on risk events.
Make endpoint tampering expensive and visible. Confirm EDR tamper protection is enforced, enable the Windows vulnerable driver blocklist and memory integrity where hardware supports it, use application control to limit which drivers load, and cut local administrator rights. Then alert when an agent stops reporting, not only when it reports a detection.
Treat uninstrumented devices as their own risk class. Inventory edge and network devices, forward their logs to central storage, keep logs well beyond 90 days, and write integrity checks and replacement into the response plan for suspected compromise.
Close the credential gap on data and SaaS platforms. Require MFA, restrict logins by network location, watch for leaked credentials and force resets when they appear, and review third-party integrations and the tokens they hold.
Take backup and hypervisor management out of the production identity domain. Separate credentials, immutable storage, MFA on management interfaces, and the same protection as the highest-value systems. Mandiant recommends treating virtualization and management platforms as Tier-0 assets.

Detection starting points

These are hypotheses to test against your own telemetry, not signatures. ATT&CK references are provided for mapping.

Hypothesis	What to look for	ATT&CK
Help-desk takeover	Password or MFA reset by the help desk, followed within minutes by a new MFA method or a sign-in from an unfamiliar device or location. Any new federated domain or identity provider added to the tenant.	T1556.006, T1484.002, T1566.004
Prompt fatigue	A burst of MFA prompts to one user followed by an approval, especially outside the user’s normal hours.	T1621
Session theft	A session reused from a new network or country shortly after token issuance, or a privileged action without a recent MFA event.	T1539
EDR tampering	Driver load events (Sysmon event 6) for drivers outside an approved list; new kernel-mode service installs (Windows system event 7045); a legitimate application loading a library with a system DLL name from its own folder; an agent that goes quiet; a sudden drop in event volume from one host.	T1562.001, T1562.006, T1574.002
Recovery sabotage	Deletion of backup objects or snapshots; hypervisor administrator logins from outside the admin network.	T1490

Unknowns and limits

M-Trends reflects incidents Mandiant investigated. Organizations that call in responders skew toward larger and better-resourced victims, so frequencies can differ in smaller environments.
No public source gives a reliable rate for EDR bypass across all intrusions. The Talos analysis covers one tool family.
Vendor and researcher naming of threat groups differs. Treat group labels as tracking handles, not settled attribution.
Specific tools will change. The controls recommended above are chosen because they still apply when a given tool is replaced.

A threat-informed program tests each important control against the way attackers get around it: for MFA, the reset path; for EDR, the driver and administrator rights; for logging, the devices that never report.

NEXT STEP