Research

What a Commercial EDR Platform Sees for Ordinary Admin Commands on Linux

Visibility, not alerting: a commercial EDR platform recorded nearly all of our benign living-off-the-land commands on another Linux distribution, but not consistently across runs.

Sennin Security Labsv1.4October 20, 20266 min read

A plain-English, vendor-neutral account of what a commercial endpoint detection and response (EDR) platform records on Linux when an administrator runs ordinary, benign commands — the kind of “living off the land” (LOTL) activity that uses built-in tools rather than custom malware. EDR is security software that watches each computer and records what programs do. The product is not named.

In a later clean-pair run on the other Linux host at 1:22 AM PT, the EDR sensor under test recorded process-start events for the positive control and for most of the script’s commands, but not for the final removal of the working directory, the hostname command, head, or the read-only sensor-state checks, although the host log shows they ran. Earlier designated runs on the other Linux host had recorded the directory removal and the hostname command. We have not determined why. The sensor therefore did not record these commands consistently across runs on the other Linux host. It raised no alert on the host.

In additional Ubuntu runs made shortly after an earlier run of the same steps, the sensor recorded only some of the commands; we have not determined why, and we exclude those runs from the claim above.

Each run removed its own working files afterward. A scratch text file left by an earlier run on October 15 remained on both lab hosts during these runs; it was not executed, sat outside the test directories, and has since been archived and removed.

A cloud provider's runtime threat-monitoring agent was also installed and running on the Linux lab hosts during these runs. It may log or act on activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on. Its effect on these results was not tested.

Environment

Lab hosts running another Linux distribution (kernel [DISTRO-KERNEL]), a commercial EDR sensor under a full-prevent policy. Identifiers that could create exposure are redacted; the host name is shown as [HOST] and the sensor’s service name as [EDR-SENSOR-SERVICE]. Methods line: tested against a commercial EDR platform in its full-prevent policy; vendor not named.

Method and commands

Each run began with a positive control — a small marker program run deliberately — so that the sensor’s own record for that control shows it was recording during the run. The operator then ran a short chain of benign built-in tools (file creation, archiving, hashing, a shell echo and a loopback connect attempt), and removed its own working files. Simplified outline of the test script:

#!/usr/bin/env bash
# SSS-RC-2026-037 Part 01 - living-off-the-land baseline (benign admin commands).
# A positive control runs first so each run shows the sensor was recording.
set -x
date; hostname
echo sss-037-posctl        # positive control marker
mkdir -p /tmp/sss-lotl-037/{bin,data,out}
uname -a; id; ps aux | head -20
systemctl is-active [EDR-SENSOR-SERVICE]
find /tmp/sss-lotl-037 -type f
tar -czf /tmp/sss-lotl-037/out/bundle.tgz -C /tmp/sss-lotl-037 data
sha256sum /tmp/sss-lotl-037/out/bundle.tgz
bash -c 'echo lotl037 >/tmp/sss-lotl-037/out/echo.txt'
curl -sS http://127.0.0.1:9/ || true     # loopback connect attempt
rm -rf /tmp/sss-lotl-037                  # each run removes its own working files

Evidence — redacted command output

Below is the real, redacted command output from one of the designated sealed runs on the other Linux host (single-script trace). It shows that the positive control marker, the inventory commands, the file-tool chain and the loopback attempt all ran on the host; it is host output, and which of these the sensor recorded varied across runs (see the claim and the disclosure above). Bracketed tokens are redactions.

A cloud provider's runtime threat-monitoring agent was also installed and running on the Linux lab hosts during these runs. It may log or act on activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on. Its effect on these results was not tested.

+ date
Tue Oct 20 06:58:52 UTC 2026
+ hostname
[HOST]
+ date -u
Tue Oct 20 06:58:52 UTC 2026
+ mkdir -p /tmp/sss-lotl-037/bin /tmp/sss-lotl-037/data /tmp/sss-lotl-037/out
+ echo sss-lab-lotl-037
+ date
Tue Oct 20 06:58:52 UTC 2026
+ printf '#!/bin/sh\necho sss-037-posctl\n'
+ chmod +x /tmp/sss-lotl-037/bin/sss-037-posctl
+ /tmp/sss-lotl-037/bin/sss-037-posctl
sss-037-posctl
+ date
Tue Oct 20 06:58:52 UTC 2026
+ uname -a
Linux [HOST] [DISTRO-KERNEL] #2 SMP PREEMPT_DYNAMIC Mon Aug 10 19:23:35 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
+ id
uid=[USER] gid=0(root) groups=0(root) context=system_u:system_r:unconfined_service_t:s0
+ ps aux
  [process table trimmed for publication]
+ head -20
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.2  0.4 173472 17960 ?        Ss   Aug29 162:16 /usr/lib/systemd/systemd --switched-root --system --deserialize=32
root           2  0.0  0.0      0     0 ?        S    Aug29   0:01 [kthreadd]
root           3  0.0  0.0      0     0 ?        S    Aug29   0:00 [pool_workqueue_release]
root           4  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/R-rcu_gp]
root           5  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/R-sync_wq]
root           6  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/R-kvfree_rcu_reclaim]
root           7  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/R-slub_flushwq]
root           8  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/R-netns]
root          10  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/0:0H-events_highpri]
root          13  0.0  0.0      0     0 ?        I<   Aug29   0:00 [kworker/R-mm_percpu_wq]
root          14  0.0  0.0      0     0 ?        S    Aug29   0:28 [ksoftirqd/0]
root          15  0.0  0.0      0     0 ?        I    Aug29   1:59 [rcu_preempt]
root          16  0.0  0.0      0     0 ?        S    Aug29   0:00 [rcu_exp_par_gp_kthread_worker/0]
root          17  0.0  0.0      0     0 ?        S    Aug29   0:03 [rcu_exp_gp_kthread_worker]
root          18  0.0  0.0      0     0 ?        S    Aug29   0:20 [migration/0]
root          19  0.0  0.0      0     0 ?        S    Aug29   0:00 [cpuhp/0]
root          20  0.0  0.0      0     0 ?        S    Aug29   0:00 [cpuhp/1]
root          21  0.0  0.0      0     0 ?        S    Aug29   0:21 [migration/1]
root          22  0.0  0.0      0     0 ?        S    Aug29   0:28 [ksoftirqd/1]
+ systemctl is-active [EDR-SENSOR-SERVICE]
active
+ date
Tue Oct 20 06:58:52 UTC 2026
+ find /tmp/sss-lotl-037 -type f
/tmp/sss-lotl-037/data/marker.txt
/tmp/sss-lotl-037/bin/sss-037-posctl
+ tar -czf /tmp/sss-lotl-037/out/bundle.tgz -C /tmp/sss-lotl-037 data
+ sha256sum /tmp/sss-lotl-037/out/bundle.tgz
[SHA-256 omitted]  /tmp/sss-lotl-037/out/bundle.tgz
+ date
Tue Oct 20 06:58:52 UTC 2026
+ bash -c 'echo lotl037 >/tmp/sss-lotl-037/out/echo.txt'
+ curl -sS http://127.0.0.1:9/
curl: (7) Failed to connect to 127.0.0.1 port 9 after 0 ms: Could not connect to server
+ true
+ date
Tue Oct 20 06:58:52 UTC 2026
+ echo '=== Chain D attempt systemd-run --user ==='
=== Chain D attempt systemd-run --user ===
+ systemd-run --user --wait /bin/true
Failed to connect to bus: No medium found
+ echo 'systemd-run exit=1'
systemd-run exit=1
+ echo '=== Chain D fallback /bin/true under bash ==='
=== Chain D fallback /bin/true under bash ===
+ bash -c /bin/true
+ echo 'bash /bin/true exit=0'
bash /bin/true exit=0
+ date
Tue Oct 20 06:58:52 UTC 2026
+ rm -rf /tmp/sss-lotl-037
+ systemctl is-active [EDR-SENSOR-SERVICE]
active
+ '[' '!' -e /tmp/sss-lotl-037 ']'
+ echo TREE_GONE
TREE_GONE
+ date
Tue Oct 20 06:58:52 UTC 2026
+ date -u
Tue Oct 20 06:58:52 UTC 2026

Limitations

• This is about visibility, not alerting: the sensor recorded nearly all of this activity (every script command except head and the read-only sensor-state checks) and raised no alert in the windows checked. That is not proof the alerting path would stay silent for genuinely malicious use of the same tools.
• A cloud provider's runtime threat-monitoring agent was also installed and running on the Linux lab hosts during these runs. It may log or act on activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on. Its effect on these results was not tested.
• Recording was inconsistent across runs on the other Linux host: a later run at 1:22 AM PT recorded fewer commands than earlier designated runs, and the cause is not determined.
• We make no comparison between operating systems. The excluded partial Ubuntu runs (see disclosure above) are not part of the claim.
• These are lab hosts under one policy; this is not a statement about any customer environment, nor a kill-score or detection-gap claim.

Methods and limitations

References

1. SSS-RC-2026-037 Part 01 final re-gate (VAL-06)
2. VAL-04 gate memo
3. VAL-03 validation record

Want to know if your endpoint defenses still work?

We test them in your environment and give you a plain written answer.