Week of November 13, 2023

A new code injection technique called Process Stomping is demonstrated, which writes shellcode directly into an existing RWX section of a suspended process to evade detection. The method avoids dynamic memory allocation and VirtualProtect calls, leveraging the RWX permissions of sections like .themida in GlassWire. A proof-of-concept loads a Cobalt Strike Beacon using sRDI without a reflective loader.

Attackers are exploiting a dangerous vulnerability in Apache ActiveMQ to bypass endpoint detection and response (EDR) systems. The exploit allows malicious activity to go undetected, posing a significant risk to organizations relying on EDR for endpoint security. This incident highlights a novel attack vector that undermines a key security control.

A researcher demonstrates a technique to evade Windows Defender detection when dumping LSASS credentials. The method combines MiniDumpWriteDump with XOR encryption, Donut shellcode generation with AMSI bypass, and process injection into notepad.exe. Windows Defender failed to detect the final payload or its activity.