Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection
A local uncensored Qwen model revised an LSASS dumper until two lab EDRs no longer detected it.
Project Black researcher Eddie Zhang reported that a locally hosted, uncensored Qwen 3.8 27B model revised a Windows LSASS credential dumper until two unnamed lab EDR products generated no detections. Hosted Claude models refused the task, while DeepSeek v4 Flash 0731 produced an initial dump that still alerted and then applied a safety guardrail. The result is limited: EDR vendors and configurations were not published, and lab success does not prove a universal bypass. Microsoft’s cited defenses include LSASS Attack Surface Reduction, Protected Process Light, and Credential Guard.
- Eddie Zhang of Project Black tested AI-built LSASS dumpers in a lab.
- Claude models refused; DeepSeek v4 Flash still triggered EDR.
- A local uncensored Qwen 3.8 27B build evaded two unnamed EDRs.
- Vendors and configurations were undisclosed, so bypass is not universal.
- Microsoft advises ASR, Protected Process Light, and Credential Guard.
- Products
- WindowsLSASSCredential Guard
- Organizations
- Project BlackAnthropic
From the original article
3 min read at cybersecuritynews.com
A locally hosted, uncensored artificial intelligence model modified a Windows credential-dumping utility until it evaded two Endpoint Detection and Response (EDR) products in a controlled lab, highlighting how accessible generative AI could accelerate custom offensive-tool development.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.