Hello, my name is Jan Ulrich. I am an offensive security specialist, and I would like to introduce my long term personal project, CE/CB, which stands for Continuous Evaluation / Continuous Bypass.

I enjoy testing AV/EDR detection capabilities, developing offensive tooling, and learning new evasion techniques. Anyone who has ever prepared for a red team operation, adversary simulation, or similar engagement has probably encountered the same situation. You are facing an unfamiliar AV/EDR product and do not know which techniques work, or a previously reliable loader is suddenly detected.

That is why I created CE/CB. The main idea is to repeatedly run malware samples, primarily loaders that execute C2 agents, in controlled and isolated laboratory environments (burning a carefully polished loader during testing is both unfortunate and, frankly, stupid). The results are then periodically evaluated against selected AV/EDR products.

I do not publish the source code of the samples, but I document the evasion techniques used.

Offensive security professionals can use the results as an indication of which evasion technique combinations are currently effective against a particular product.

Defenders can use the results to identify potential gaps in their current AV/EDR coverage and improve their detection capabilities.

The tests are divided into two stages. The first stage records what happens when the sample is written to disk and whether it is detected or not detected. The second stage records what happens when the sample is executed. To ensure that the results are practical rather than statistics without context, the loader launches a C2 agent that connects to the command and control server and executes a small set of basic commands. As the final step, the C2 agent writes a test file to disk. If the file is written successfully and the AV/EDR product does not detect any part of the activity, the scenario is marked as not detected. In my opinion, writing a new file to disk is more detectable than many quieter actions, so it gives the test useful and practical weight.

The project is still at an early stage of development, but it is ready to be shared publicly. In the near future, I plan to add more AV/EDR products, test scenarios, and samples. If you have an idea for improving the project, are interested in hiring my services, or simply want to tell me that you like the project, email me at [email protected] with CE/CB in the subject line. Every message will be used as a small dopamine injection to boost my motivation and help improve the project.

P.S. Please do not try to hack this website. It is a static website hosted on Cloudflare and completely isolated from my infrastructure. :)

It is not rocket science, but for now I reveal its architecture and the technologies used only during my conference talks.