Week of August 7, 2023

SafeBreach Labs researchers discovered vulnerabilities in several EDR products that allow remote deletion of critical files and databases without authentication. By inserting minimal malicious signatures into files like web server logs, attackers can trick EDRs into automatically deleting the file, leading to data loss and denial of service. The research was presented at Black Hat USA 2023.

Researchers at SafeBreach discovered a security feature bypass vulnerability in Microsoft Defender's signature update process, tracked as CVE-2023-24934. The flaw allows an unprivileged user to hijack the update mechanism to inject malware, delete benign files, or remove threat signatures. Microsoft patched the vulnerability in April 2023.

A SafeBreach researcher created a proof-of-concept ransomware that encrypts files on a victim's endpoint by abusing Microsoft OneDrive's sync functionality, without executing malicious code locally. The technique leverages stolen OneDrive access tokens and junction points to manipulate files remotely, evading standard endpoint security detection.