LockBit affiliates do not need artificial intelligence to beat an EDR agent. What works is killing it with a vulnerable signed driver, unhooking its API monitoring, or routing the attack through Windows tools it already trusts. GenAI shows up in the phishing lure, not the exploit.
- BYOVD, bring your own vulnerable driver, is still the most reliable way to kill an EDR agent, and it predates GenAI tooling.
- API unhooking and direct syscalls bypass userland hooks without a kernel exploit.
- Living off the land binaries run damaging steps through processes the EDR already trusts.
- "AI-powered EDR bypass" is largely marketing; the real AI contribution is lure quality, not detection evasion.
- CBUAE and NESA assessors ask for tamper protection and monitored response, not AI claims.
How an EDR Agent Actually Sees an Attacker
An EDR agent hooks the OS at several layers: API calls in userland, kernel callbacks for process and file events, telemetry to a cloud console. A behavioural match, such as a Word document spawning PowerShell that reaches the internet, gets the process killed or the host isolated. None of that needs a trained model, only accurate telemetry and tuned rules. The gap attackers exploit is not the detection logic; it is that the agent is software running with high, not unlimited, privilege.
The Techniques LockBit Affiliates Actually Use
Bring Your Own Vulnerable Driver
BYOVD is the technique behind most LockBit-linked EDR defeats. The operator drops a legitimately signed but flawed third-party driver, loads it with ordinary privilege escalation, and abuses its own broken functionality to kill protected processes, including the EDR's kernel component. Tools built on this idea circulate on criminal forums and target backup and anti-cheat drivers. It is a patching and allowlisting problem as much as an EDR one; a current vulnerable driver blocklist closes most of it.
Unhooking and Living Off the Land
Agents hook Windows API functions in userland, ntdll.dll being the classic target. Malware that restores the original bytes over the hooked copy, or calls straight into the kernel, removes those hooks without any exploit. Operators also move laterally with signed tools such as PsExec and WMI, since an EDR tuned for malware often tolerates them because ordinary IT software uses the same binaries. LockBit's affiliate model means skill varies, and this is often where a well-configured EDR still catches the intrusion.
Where the GenAI Framing Overstates the Threat
The real AI story sits upstream of the bypass. Language models write more convincing phishing in fluent, regionally appropriate English or Arabic, and lower the skill bar for obfuscated PowerShell, which matters for awareness training. What is not defensible is claiming a model analyses an EDR's detection logic mid-attack and adapts live. That framing sells vendor products; the documented LockBit techniques are the same driver abuse and living-off-the-land tradecraft researchers have tracked for years.
What This Means for UAE Banking
CBUAE's cybersecurity requirements and the broader NESA-derived control set expect tamper-resistant endpoint protection, not just detection: an agent resisting local termination, a kernel driver protected against BYOVD, and a monitored SOC treating agent silence as an incident, not a gap. CrowdStrike Falcon and Microsoft Defender for Endpoint both ship tamper protection and driver blocklisting, but these need enforcing through policy, not a troubleshooting exception. An assessor wants proof tamper protection is enforced fleet-wide, and a documented incident response plan assuming the endpoint layer can be blinded.
A Practical Checklist
- Enable tamper protection fleet-wide, not per device group.
- Push the vulnerable driver blocklist and audit drivers.
- Alert on agent uninstall or telemetry gaps as their own SOC use case.
- Restrict and log PsExec, WMI and unconstrained PowerShell outside change windows.
- Treat "AI-powered" claims as marketing until a researcher or CVE backs it. See how LockBit ransomware actually works.
