Week of November 6, 2023

P.I.V.O.T Security researchers demonstrated a technique called Bring Your Own Reputation (BYOR) that abuses Microsoft SmartScreen's reputation-based trust by sideloading unsigned executables through legitimately-reputed script files (.bat, .cmd, .vbs) containing insecure code paths. This bypasses Mark-of-the-Web (MOTW) and SmartScreen warnings without requiring an EV certificate, and Windows Defender remained silent during the proof-of-concept. The technique highlights that file reputation alone is insufficient for detection, and behavioral monitoring of child processes spawned from script files is necessary.

A proof-of-concept tool named Darkside was published on GitHub, demonstrating a Bring Your Own Vulnerable Driver (BYOVD) attack to terminate antivirus and EDR processes. It uses a less-known vulnerable driver (truesight.sys) to achieve kernel-level access and disable security software. This highlights the ongoing risk of BYOVD techniques against endpoint protection.

Researchers analyzed an EDR's update mechanism and discovered a logic flaw allowing complete disarmament. They found a command 'unshield_from_authorized_process' that disables protections if invoked by a process signed by the vendor. A new LOLBin was also discovered within the EDR's own signed binaries, enabling bypass of self-protection.

A vulnerability in Elastic Endpoint versions 7.9.0 through 8.10.3, when debug logging is enabled and logs are collected by Elastic Agent, causes Elastic Agent API keys to be written in plaintext to Elasticsearch. This could allow an attacker with access to those logs to read sensitive endpoint artifacts and write arbitrary data.