Week of February 19, 2024

A proof-of-concept repository demonstrates a method to bypass Windows Patch Guard by hooking NtCreateFile and NtOpenProcess, tested on Windows 10 22H2. The technique reportedly evades detection by several anti-cheat systems and remains stable without blue screens for nearly a day.

Two vulnerabilities were discovered in OpenEDR's DLL injector module: the driver does not verify the signature of the DLL it injects, and it searches for the DLL in an unprotected path (System32) before the protected installation path. An attacker with administrator privileges can replace the legitimate DLL with a malicious one, causing the EDR driver to inject malicious code into every monitored process, compromising system confidentiality and integrity.

A GitHub repository named 'av-edr-bypass-1' was published as a case study demonstrating a technique to bypass antivirus and EDR detection. The repository contains C++ code and has garnered modest community attention. It serves as a proof-of-concept for security researchers and engineers.