Week of June 5, 2023

A command injection vulnerability in Trellix Agent for macOS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ folder. The malicious file is executed when the TA deployment feature is run from the System Tree. This could lead to arbitrary code execution with high privileges.

CVE-2023-34257 is a critical vulnerability in BMC Patrol agent through version 23.1.00 that allows remote unauthenticated modification of agent configuration. Certain SNMP-related configuration fields lead to code execution when the agent is restarted. The vendor considers authentication an optional implementation choice.

A security researcher published a proof-of-concept demonstrating a custom process unhooking technique that bypasses Windows Defender on fully updated Windows 11. The method removes security hooks from loaded DLLs and restores original addresses, allowing an implant to execute undetected. The researcher plans to test against other vendors, such as Symantec IPS, in a future POC.

Researchers demonstrated a proof-of-concept polymorphic keylogger, BlackMamba, that uses the ChatGPT API at runtime to generate mutating malicious code, evading endpoint detection and response (EDR) systems. The technique leverages prompt engineering to bypass ChatGPT's content filters and dynamically creates new code variants on each execution. This highlights the potential for AI-assisted malware to lower the barrier for attackers and challenge current endpoint security solutions.