Sophos X-Ops analysts published research this week concerning an unidentified threat actor using AI technology to develop endpoint detection and response (EDR) evasion tactics through the lens of what the company described as a "red team" post-exploitation framework. 

"The activity was detected when an anomalous endpoint registered within a customer tenant triggered alerts for payloads originating from C:\Users\User\Documents\test," Sophos said in its blog post. "Multiple files in this directory were malicious and indicative of a broader attack framework focused on evading detection." More here