Evaluating Endpoint Detection Robustness Against Genetic Algorithm Driven Code Transformations

arXiv:2607.07191 · cs.CR · Submitted 2026-07-08 · Read on arXiv

Alvina Rwaichi Minja, Jema David Ndibwile

cs.CR

Submitted: 2026-07-08

Comments: 9 pages, 2 figures, 5 tables, 10th International Conference on Cryptography, Security and Privacy

Code: https://github.com/Screetsec/TheFatRat

License: http://creativecommons.org/licenses/by/4.0/

The gist: Post-compromise test variants are widely used in controlled security evaluation and endpoint robustness benchmarking.

Terminology

Abstract

Post-compromise test variants are widely used in controlled security evaluation and endpoint robustness benchmarking. However, modern Antivirus (AV) and Endpoint Detection and Response (EDR) systems increasingly combine signature- and behavior-based detection, challenging the reliability of conventional detection pipelines under adaptive variation. This study introduces ShellForge, a Genetic Algorithm (GA)-driven framework that evolves post-compromise variants representative of remote command execution to generate functionally equivalent variants for systematic detection evaluation. ShellForge applies syntactic transformations, encoding schemes, and structural permutations guided by a multi-objective fitness function informed by AV and EDR detection feedback. We compare ShellForge against representative baseline transformation frameworks under identical sandbox configurations. Our findings highlight measurable robustness gaps in baseline signature- and behavior-oriented detection pipelines under controlled variant generation. In addition, we propose a reproducible benchmark for endpoint detection robustness evaluation, motivating the need for robustness-aware defensive monitoring and behavioral correlation.

Related papers