Week of September 25, 2023

CVE-2023-44976 is a vulnerability in Hangzhou Shunwang Rentdrv2 driver before version 2024-12-24. It allows local users to terminate EDR processes via a DeviceIoControl call with control code 0x22E010 due to an exposed IOCTL with insufficient access control. The vulnerability has been exploited in the wild since at least October 2023.

EDRSnowblast is a fork of the EDRSandblast tool that adds new features for bypassing EDR detection, including loading unsigned kernel and minifilter drivers, and a 'filter-mute' technique to disrupt communication between EDR user-mode and kernel-mode components. It builds on existing kernel callback removal and userland unhooking methods to evade endpoint security products.

A proof-of-concept demonstrates how the Echo Anti-Cheat driver (EchoDrv) can be abused to disable endpoint security products. It patches kernel notify routines and disables ETW for the Windows Threat Provider, effectively blinding EDR and AV. The technique highlights risks from third-party kernel drivers with elevated privileges.

A vulnerability in Windows Boot Applications allows an attacker with physical access or administrative privileges to bypass Secure Boot by using the 'truncatememory' BCD element to remove the serialized Secure Boot policy from memory. This enables loading of unsigned or test-signed code, undermining the integrity guarantees of Secure Boot. The issue was patched by Microsoft in January 2022.

Researchers discovered a method to disable ETW-Ti security event generation for specific processes on Windows 10, allowing malware to evade EDR detection during operations like memory dumping and code injection. The technique leverages undocumented NtSetInformationProcess flags to turn off logging for inter-process memory reads/writes and thread/process suspension. This bypass affects all EDRs relying on ETW-Ti for telemetry.