Week of October 2, 2023

A proof-of-concept self-injecting dropper combining call stack spoofing via Windows thread pooling and indirect syscalls to evade EDR detection was published on GitHub. The technique hides malicious call origins by making them appear as legitimate ntdll activity. This demonstrates a practical method for bypassing userland hooking and call stack analysis used by security products.

A proof-of-concept tool called GuardBypassToolkit bypasses Windows Defender by manually loading DLLs, parsing the Export Address Table (EAT), and updating the Import Address Table (IAT) with unhooked functions. It includes an LSASS dumper and in-memory Mimikatz execution, using EAT hooking to redirect AmsiScanBuffer to a custom function that always returns clean.

CVE-2023-3665 is a code injection vulnerability in Trellix Endpoint Security (ENS) 10.7.0 and earlier. It allows a local attacker to disable the AMSI component via environment variable manipulation, leading to potential denial of service and arbitrary code execution. The vulnerability was published to NVD on 2023-10-04.