Week of February 12, 2024

IBM disclosed CVE-2024-22335, a vulnerability in QRadar Suite and Cloud Pak for Security that allows a local user to read sensitive information from log files. The flaw stems from improper handling of log content, potentially exposing sensitive data. Affected versions include QRadar Suite 1.10.12.0 through 1.10.17.0 and Cloud Pak for Security 1.10.0.0 through 1.10.11.0.

A new technique called EDR-Preloading leverages AppVerifier and ShimEngine callbacks in ntdll.dll to execute malicious code before the EDR's user-mode DLL is loaded, effectively preventing the EDR from hooking functions. This bypasses user-mode detection without relying on direct or indirect syscalls. The method exploits the process initialization order in Windows to preempt EDR injection.

A researcher demonstrated a proof-of-concept bypass of SentinelOne EDR by using a custom .NET loader to execute Rubeus. The loader employed evasion techniques including AMSI and ETW hooking via hardware breakpoints and AES encryption. This allowed subsequent Kerberos constrained delegation abuse to impersonate a Domain Administrator.