There is no such thing as an undetectable implant — there are implants whose authors measured, and implants whose authors hoped. Detection is a moving target staffed by smart people with kernel drivers, so any honest claim has to be pinned to three coordinates: which engines, which artifact, which day. Everything else is marketing. This is why the AXIS build pipeline does not end at compile; it ends at the evaluation lab, and a revision ships only when the lab says so.
The matrix: engines times lanes
The lab tracks the AV/EDR field as engine families — the products your targets actually run, from the kernel-sensor heavyweights to the static-ML scanners that never execute anything. The agent itself fingerprints sixteen EDR vendors at runtime to gate its own behavior; the matrix is the lab-side mirror of that same list. Every build is exercised against every tracked family in three lanes, on instrumented hosts whose telemetry we read afterwards:
Static — the artifact, at rest: scanners, static ML, reputation. On-execute — the moment of delivery: AMSI, script and macro lanes, the first seconds of process life. Behavioral — a post-execution window in which the agent does real work: beacons, loads a module, opens a tunnel, installs persistence — while the engine's sensors and cloud verdicts get their chance. Then the telemetry review: what did the host record, even when nothing fired?
for family in tracked_engines:
for lane in [static, on_execute, behavioral]:
require no_blocking_verdict(build, family, lane)
require telemetry_review_clean()
ship(rev) # rev 0328: all lanes, all families — zero blocking verdicts
Rev 0328 completed the matrix with zero blocking verdicts — every family, every lane. We state it that way on purpose: not undetectable, but measured, pinned, and falsifiable. A matrix is a snapshot. Engines ship updates on their own schedule, and the next revision of AXIS will run the same lanes again, because that is what the word current means.
When a lane fails
A red cell is not an embarrassment; it is an engineering input. When a family catches something, the finding flows into the routing layer the operator already sees: the builder's choice between the full and minimal stager families exists because the matrix says which door fits which watch. The agent's EDR-aware gating — sixteen vendors fingerprinted from service names and registry, behavior adjusted accordingly — exists because the lab keeps a living list of who punishes which move. The verify first cells in the licensee delivery matrix are the honest residue of this loop: we would rather mark a cell than let you discover it in front of a client.
Dead ends, preserved
A lab that only publishes wins is a brochure. Earlier this year we spent roughly thirty commits spiking a persistence idea through the Windows shim-database infrastructure — elegant on paper, dead in practice. The spike root-caused exactly why: an allowlist on the shim engine, a platform-bit the registration API never sets the way we needed, and per-file negative entries cached in the kernel that survive cleanup. We closed it as a NO-GO and kept every note. That folder is why the persistence lineup that did ship — Ghost-Svchost's per-install metamorphic stub, Ghost-Path — is built on mechanisms we can defend line by line, and why the next idea gets measured against the failed one instead of against a fantasy.
The lab is not the only witness. Field checks on instrumented customer-shape hosts close the loop — most recently, a persistence install that registered, started, and beaconed as SYSTEM on a box running both SentinelOne and Defender, with both engines silent. One check proves little; a method that keeps producing checks like it is the product.
The defender's angle
Zero verdicts is a measurement, not a magic trick.
Read our result the way we do: a pinned snapshot across named lanes, not an invisible cloak. The seams are where they always are. Per-build polymorphism makes hash intelligence rot instantly — invest in behavior, not IOC feeds. The loud moment is delivery: script and AMSI lanes, macro content, the first seconds of an unknown process. Persistence that installs per-install-unique artifacts defeats name-based hunts but not mechanism-based ones — watch the mechanisms, not the filenames. And a vendor that publishes its evaluation method is handing you its failure modes along with its claims; we publish the method because the claims are only worth what the method is worth. Measure the seams — we'd rather be caught by a good rule than believed on a bad adjective.
Next note: What convicts an injector? — a controlled bait series against SentinelOne + Defender that puts the lab's method to work on injection folklore: six patterns, two controls, and a verdict that inverts the folklore.