Week of April 29, 2024

A public proof-of-concept repository demonstrates bypassing Event Tracing for Windows (ETW) by patching the EtwEventWrite function in memory. The technique checks for hooks on NtProtectVirtualMemory and NtAllocateVirtualMemory, then overwrites EtwEventWrite with patch bytes to suppress telemetry. This matters because ETW is heavily relied upon by EDRs and security tools for visibility.

Researchers detail multiple techniques to bypass Event Tracing for Windows (ETW)-based EDR detection, including disabling ETW providers, patching EtwEventWrite in memory, and using direct syscalls to evade hooks. These methods undermine the visibility that many EDR solutions rely on for threat detection.

A proof-of-concept tool demonstrates a lifetime AMSI bypass by locating and patching specific opcode patterns in the AMSI DLL. The technique searches for a sequence of instructions in memory and modifies them to disable AMSI scanning, potentially evading endpoint detection.

A vulnerability in PowerShell's System.Management.Automation.dll allows overwriting a writable entry containing the address of AmsiScanBuffer, enabling AMSI bypass without VirtualProtect. Discovered by OffSec trainer Victor Khoury, it affects PowerShell 5.1 and 7.4 on Windows 10/11. Reported to Microsoft on April 8, 2024.

A privilege escalation vulnerability exists in WRSA.EXE, a component of Webroot Antivirus versions 8.0.1X through 9.0.35.12 on 32-bit and 64-bit Windows. The flaw allows malicious software to leverage WRSA.EXE to delete arbitrary and protected files, potentially leading to system compromise.

CVE-2024-23463 is a TOCTOU race condition in Zscaler Client Connector for Windows that allows low-privileged attackers to bypass anti-tampering protections during the Repair App operation. Successful exploitation could let attackers disable or manipulate the security agent, compromising endpoint integrity. The vulnerability was published in April 2024 and patched in version 4.2.1.

CVE-2024-23774 is an unquoted Windows search path vulnerability in Quest KACE Agent for Windows versions 12.0.38 and 13.1.23.0. It affects the KSchedulerSvc.exe and AMPTools.exe components, allowing local attackers to execute arbitrary code with SYSTEM privileges. This is a local privilege escalation issue in an endpoint management agent.