Week of January 15, 2024

A proof-of-concept demonstrates bypassing Microsoft's Anti-Malware Scan Interface (AMSI) by patching the AmsiScanBuffer function in memory to always return AMSI_RESULT_CLEAN. The technique modifies assembly instructions to evade signature-based detection, enabling execution of malicious PowerShell scripts like Mimikatz. This highlights ongoing evasion tactics against endpoint security controls.

A proof-of-concept exploit for the HackSys Extreme Vulnerable Driver (HEVD) demonstrates bypassing Kernel Virtual Address (KVA) Shadow and Supervisor Mode Execution Prevention (SMEP) on Windows 10 22H2. The exploit uses an arbitrary overwrite vulnerability in HEVD to modify a PML4 entry, enabling kernel-mode code execution from a medium integrity process. This highlights a technique for defeating kernel exploit mitigations when a vulnerable driver is present.

Microsoft detected a nation-state attack on its corporate systems on January 12, 2024, attributed to Russian state-sponsored actor Midnight Blizzard (NOBELIUM). The actor gained initial access via password spray on a legacy non-production test tenant without MFA, then abused OAuth applications to move laterally and access email accounts. This incident highlights risks from legacy accounts and OAuth application misuse in cloud environments.

A threat actor named Spyboy is selling a tool called Terminator that uses the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate processes of endpoint security products. The tool loads a vulnerable Zemana anti-malware driver to execute code in kernel mode, bypassing user-mode protections. SentinelOne detects known samples, and organizations are advised to review provided indicators of compromise.

A user on Stack Exchange investigated whether Windows Defender's Tamper Protection can be disabled programmatically using the 'start windowsdefender:' URI scheme, similar to enabling real-time protection. The attempt was unsuccessful, and the discussion highlights that no built-in, documented method exists to disable Tamper Protection from a script without high privileges or third-party tools. This matters because Tamper Protection is a key defense against unauthorized changes to Defender settings by malware or attackers.