A locally hosted, uncensored artificial intelligence model modified a Windows credential-dumping utility until it evaded two Endpoint Detection and Response (EDR) products in a controlled lab, highlighting how accessible generative AI could accelerate custom offensive-tool development.
The experiment, published by Project Black researcher Eddie Zhang, targeted the Local Security Authority Subsystem Service (LSASS), whose memory may contain authentication material useful for lateral movement after an attacker obtains administrative access.
The project began with a deliberately challenging benchmark: could an AI create an executable capable of dumping LSASS without modern EDR detecting it, while requiring little human direction? This is a consequential test because MITRE ATT&CK tracks LSASS memory dumping as T1003.001, a Credential Access sub-technique. Administrative or SYSTEM-level users can harvest credentials from LSASS memory and reuse them to authenticate to additional systems.
According to Zhang, attempts to generate the dumper with Claude Opus 5, Opus 4.8, and Sonnet 5 produced immediate refusals, despite his organization’s approval under Anthropic’s Cyber Verification Program.
He then tested the open-weight DeepSeek v4 Flash 0731 model. After several prompts, DeepSeek produced a functioning executable that accepted a process identifier, created a suspended clone of the target through reflection, generated an in-memory minidump, XOR-encrypted it, and wrote the encrypted output to disk.
The researcher validated the resulting dump with pypykatz, confirming it could be parsed, but the initial executable still triggered EDR detection. When asked to improve stealth, DeepSeek invoked a safety guardrail.
Zhang therefore moved the code to an uncensored, community-modified Qwen 3.8 27B model, running locally on a password-cracking rig equipped with two Nvidia RTX 4090 graphics cards.
Local AI Bypasses EDR
With only a request to make the executable “more stealthy,” the local model returned a revised build that generated no detections across either of the two EDR platforms available in the lab, Zhang reported.
Code review showed that Qwen had altered process-spawning behavior, reduced access masks requested against the target process, inserted randomized delays during minidump construction, changed the output filename and path, and scrubbed embedded strings from the binary.
Those modifications matter because many defenses correlate recognizable artifacts: suspicious process ancestry, high-privilege handle requests to LSASS, known strings, dump-file creation, and tightly timed behavior.
Elastic, for example, documents a tool-agnostic rule that monitors LSASS handle requests with access masks frequently used by dump utilities, while MITRE describes detection through a sequence of abnormal process access followed by memory dumping or file creation.
The finding is significant, but its scope remains limited. The EDR vendors were not named, configuration details were not published, and success against two laboratory products does not establish universal bypass capability.
It nevertheless shows how local, guardrail-free models can iteratively reshape known offensive code without sending prompts or source code to a hosted service, lowering the expertise and time needed to produce environment-specific variants.
Defenders should treat EDR as one layer rather than a guarantee. Microsoft recommends enabling the LSASS credential-stealing Attack Surface Reduction rule with tamper protection, running LSASS as Protected Process Light, deploying Credential Guard, restricting RDP administration, and disabling WDigest credential caching.
Organizations should also minimize local administrator rights, separate privileged accounts, use unique credentials, monitor unusual LSASS access, and rapidly isolate hosts showing credential-dumping behavior.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
