Week of October 16, 2023

AceLdr is a user-defined reflective loader (UDRL) for Cobalt Strike that evades multiple memory scanners by encrypting heap allocations, obfuscating code, and spoofing return addresses. It was tested against tools like Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, and MalMemDetect, producing zero detections. The technique demonstrates a practical bypass of endpoint memory scanning defenses.

A user reported that Datadog Agent 7.54.1.0 on Windows includes OpenSSL 3.0.8 DLLs vulnerable to CVE-2023-4807 and other CVEs, as detected by Azure Cloud Defender. The issue persisted through multiple agent updates until Datadog confirmed all CVEs were patched in version 7.64.3.

A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XSOAR engine software on Linux. An attacker with shell access to the engine can execute programs with elevated privileges. The issue is fixed in updated engine installers from Cortex XSOAR 6.10 build B250144 and later.

Between August 2022 and May 2023, an updated MATA backdoor framework targeted defense and oil/gas firms in Eastern Europe via spear-phishing. Attackers gained access to endpoint security admin panels and used them to surveil infrastructure and distribute malware. They bypassed EDR using a public exploit for CVE-2021-40449 (CallbackHell) and BYOVD techniques.

CSIS Security Group discovered a bypass technique in Microsoft Defender for Endpoint (MDE) during an incident response engagement. The weakness allowed attackers to operate undetected on compromised servers with domain admin privileges. CSIS has reported the issue to Microsoft and will disclose full details after a fix is available.

Researchers presented a technique called VEH2 that abuses Windows Vectored Exception Handling to bypass EDR/XDR monitoring and AMSI. The method uses multiple Vectored Exception Handlers to alter control flow and execute malicious code discreetly. This poses challenges for detection and analysis by security products.