Challenge 11: Pre-Existing Process

Objective

Have a “malicious” process running that the EDR never detects because it was started before the EDR.

Scanner Behavior

On startup, the EDR takes an initial snapshot and marks all existing processes as “known”:

let initial = enumerateProcesses()
gKnownPids = initHashSet[DWORD]()
for p in initial:
  gKnownPids.incl(p.pid)

Processes in the initial snapshot are never analyzed. The EDR only monitors for NEW processes.

Rules

• Start a blacklisted tool or suspicious process BEFORE the EDR starts
• The process must still be running when the EDR starts
• Verify that the EDR does not detect or report it

Hints