Bypassing AVs and EDRs With New Command-Line Obfuscation Technique

Researchers have uncovered advanced command-line obfuscation methods that allow attackers to bypass detection systems such as antivirus (AV) and endpoint detection and response (EDR) platforms. 

The techniques, detailed in a comprehensive study released on March 24, 2025, exploit parsing inconsistencies in executable files to hide malicious commands in plain sight, posing a significant threat to organizations relying heavily on command-line-based detections.

In recent years, cybersecurity has witnessed a dramatic shift in attack methodologies. According to the research, over 75% of intrusions observed by CrowdStrike in 2024 were completely “malwareless,” with threat actors leveraging legitimate system utilities and trusted executables rather than custom malware. 

This trend has forced security solutions to focus on command-line arguments to differentiate between legitimate and malicious uses of trusted tools.

“Threat actors have been countering detection mechanisms by tweaking the command-line arguments they use,” explains the research. 

“This technique, known as command-line obfuscation, attempts to masquerade the true intention of a command with the ultimate goal of bypassing threat detection or misleading analysts.”

How Command-Line Obfuscation Technique

According to Wietze Beukema, unlike other obfuscation methods such as DOSfuscation or PowerShell obfuscation, command-line obfuscation is shell-independent, targeting vulnerabilities in how executables parse their arguments. 

When a command is executed with these obfuscation techniques, the obfuscated version is what gets recorded by security monitoring tools.

Consider this simple example that would evade many detection rules:

This uses dash characters instead of the traditional forward slash format (/f /im), making it harder for security tools to detect malicious process termination.

More sophisticated techniques include:

• Character substitution: reg eˣport HKLM\SAM out.reg
• Quote insertion: reg “s”a”v”e H”KL”M\S”AM” out.reg
• Character deletion: powershell -en [encoded payload] instead of -encodedcommand
• Value transformations: ping 2130706433 instead of ping 127.0.0.1
• URL manipulation: msiexec https:\\example.org/install.msi instead of using https://

Security researchers have released ArgFuscator[.]net, a new platform documenting obfuscation opportunities across 68 common Windows executables. 

The tool generates obfuscated command lines that function identically to their unobfuscated counterparts while evading detection.

“A video demonstration shows how a certutil.exe command attempting to download a file is blocked by Windows Defender, but when obfuscated using ArgFuscator.net, it works without issue,” reads the report.

Defensive Countermeasures

Security experts recommend several approaches to address this vulnerability:

• Implement detection rules for command lines containing high Unicode range characters
• Flag command lines with anomalous patterns like excessive quotation marks
• Normalize command-line arguments before evaluation
• Focus on events that cannot be easily spoofed, such as network connections

“As a general recommendation, writing resilient detections is good practice: define detection logic in a way that detects keywords of interest, even when obfuscation is applied,” advises the research.

The discovery of these techniques underscores the ongoing cat-and-mouse game between attackers and defenders, with each new defensive measure potentially spawning innovative evasion techniques. 

Security teams should immediately evaluate their detection methods against these obfuscation techniques to ensure proper coverage.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy