← Catalog
Research high discovered 2019-07-18

Bypassing Cylance's AI Malware Detector with Appended Strings

Researchers reverse-engineered Cylance's ML malware model, found which features drove 'benign' scores, and appended strings from a trusted game to real malware — flipping the classifier's verdict on a large sample of known-malicious files.

Discovery AI Attack Staging Initial Access Defense Evasion Impact

What happened

Catalogued by MITRE ATLAS as AML.CS0003, Skylight Cyber researchers analyzed Cylance’s AI-based malware detector and discovered a global bias: the model heavily weighted features associated with a particular trusted online game. By appending selected strings from that game to genuinely malicious files, they could push the classifier’s score toward “benign” — without changing the malware’s behavior at all.

Applied to a set of known-malicious samples, the trick flipped a large fraction to benign verdicts. It is a landmark demonstration that a security product’s ML model is itself an attack surface: understand its feature weighting, then craft adversarial input to evade it.

Why it maps to ATLAS

  • AML.T0013 — Discover AI Model Ontology: the attackers reverse-engineered how the model weighs features.
  • AML.T0043 — Craft Adversarial Data: appended strings are crafted to game those features.
  • AML.T0015 — Evade AI Model: malware is misclassified as benign.

Detection notes

Static ML verdicts are gameable when a single model is the sole gate. Ensemble the ML score with signature and behavioral detection, adversarially train the classifier, and flag files whose verdict swings dramatically from small, non-functional appends (trusted-app strings grafted onto unrelated binaries is a strong tell). Behavior at execution time doesn’t lie the way a static feature vector can.

Detection

Log sources

  • EDR verdict + model-score telemetry
  • File-structure / appended-overlay analysis

Signals

  • Known-malicious files suddenly scoring benign after minor appends
  • Trusted-application strings/overlays grafted onto unrelated binaries
  • Large verdict swings from small, non-functional file changes

Mitigations

  • Ensemble ML with signature/behavioral detection; don't rely on one model
  • Adversarial-train the classifier; monitor for feature-gaming overlays
  • Post-execution behavioral analysis independent of static ML score