Week of May 29, 2023

Security researcher Gabriel Landau released EDRSandblast-GodFault, a proof-of-concept tool that removes kernel callbacks from EDR drivers like Microsoft Defender (WdFilter.sys) without using a vulnerable driver. It leverages the GodFault technique to gain kernel-level access and disable process, thread, and image load notifications, as well as ETW Threat Intelligence. This demonstrates a driverless method to blind EDR sensors.

Security researcher icyguider released LightsOut, an open-source Python tool that generates an obfuscated DLL to disable AMSI and ETW in Windows processes. The tool uses techniques like WinAPI randomization, XOR string encoding, and sandbox checks to evade AV detection. It is intended for penetration testing to execute malicious PowerShell scripts without being blocked.

Kaspersky detected a sophisticated spyware campaign, dubbed Triangulation, targeting iPhones of its employees via zero-click iMessage exploits. The spyware exfiltrates sensitive data including microphone recordings, photos, and geolocation. Detection was achieved through Kaspersky's SIEM, KUMA, which identified anomalous network activity from iOS devices.

A video and Reddit post surfaced on May 28, 2023, showing an executable that allegedly disables tamper protection and terminates the on-premise agents of numerous endpoint security products. The tool claims to work against vendors including CrowdStrike, SentinelOne, Carbon Black, and Windows Defender. ThreatLocker notes that its application allowlisting would block such an unknown executable from running.

A threat actor is selling a tool called Terminator that uses a Bring Your Own Vulnerable Driver (BYOVD) attack to terminate antivirus, EDR, and XDR processes. The tool drops a legitimate but vulnerable Zemana anti-malware driver (zamguard64.sys or zam64.sys) to gain kernel-level privileges and kill security software user-mode processes. CrowdStrike confirmed the technique is a BYOVD attack, not a novel bypass.

Microsoft discovered a macOS vulnerability named 'Migraine' that allows a root attacker to bypass System Integrity Protection (SIP) by exploiting the migration daemon's inheritable entitlement. The flaw, tracked as CVE-2023-32369, was patched by Apple on May 18, 2023. It could enable persistent malware, rootkit installation, and expanded attack surface.

A guide demonstrates patching AMI Aptio V UEFI firmware to disable image signature verification, allowing unsigned executables to load under Secure Boot. This bypasses a foundational platform security feature, potentially enabling malware or cheat software to run undetected.