Week of July 3, 2023

A proof-of-concept tool named WFP_EDR was published on GitHub, demonstrating how to abuse the Windows Filtering Platform (WFP) to block endpoint detection and response (EDR) agents from communicating with their cloud backends. The tool requires local administrator privileges and can target specific EDR products like Cortex XDR and Windows Event Forwarding. It highlights a technique that could allow attackers to evade detection by severing the telemetry link between the endpoint and the security vendor.

A security researcher published a proof-of-concept technique to unhook CrowdStrike Falcon's syscall hooks in ntdll.dll without using VirtualProtect or loading a fresh ntdll.dll. The method follows hook jumps to locate the relocated syscall stub by searching memory for the return address, then patches the hook with a custom jump. This demonstrates a potential evasion method, though the author notes it is highly targeted and fragile.

CyberCX published a research article and Frida scripts demonstrating how to bypass jailbreak detection in Flutter iOS apps using the IOSSecuritySuite library. The technique hooks into the runtime to disable detection checks, enabling mobile app security testing. This matters because it provides a reusable method for penetration testers to overcome anti-tampering protections in Flutter-based applications.

A researcher recreates the Spyboy 'Terminator' EDR bypass tool, which uses a signed vulnerable Zemana Anti-Malware driver (CVE-2021-31728) to gain kernel access and terminate EDR processes. The technique leverages a known BYOVD attack to disable security products. This demonstrates a practical, low-cost method for evading endpoint detection.