Week of September 11, 2023

The Akira ransomware group has been observed deploying ransomware from newly created, unmonitored virtual machines on Windows Hyper-V hosts to evade endpoint detection and response (EDR) tools. This technique allows attackers to encrypt virtual disk files while bypassing security controls that are not installed on the attacker-created VMs. The group also attempted to use the open-source Terminator BYOVD tool to disable EDR, but it was detected and blocked.

Researchers analyzed the STRANGETRINITY EDR agent's communication channel and discovered a COM interface method that, despite ACL restrictions, could be invoked to extract configuration details. This allowed them to intercept and tamper with agent-tenant communications, potentially enabling command execution or EDR disabling. The work highlights risks when an attacker has administrative access to the endpoint.

A denial-of-service vulnerability in multiple Windows EDR products allows a low-privileged user to permanently disable the agent after a reboot by preemptively registering an ALPC port name used by the EDR. The affected EDRs fail to handle the case where the port is already in use, causing user-mode components to crash or become non-functional. Kernel components remain running but lose detection/blocking capabilities in most cases.

CVE-2023-38163 is a security feature bypass vulnerability in Microsoft Windows Defender Attack Surface Reduction (ASR) rules. It allows an attacker with local access and user interaction to circumvent ASR protections, potentially enabling malicious code execution. The flaw undermines a key endpoint defense layer used to block common attack techniques.

A TOCTOU race condition in N-able Take Control Agent's BASupSrvcUpdater.exe allows a local low-privileged attacker to delete arbitrary files via pseudo-symlink exploitation. The vulnerability affects versions through 7.0.41.1141 and can lead to denial of service, privilege escalation, or system compromise. Mitigation involves updating to version 7.0.43 or later.