Week of June 3, 2024

A public GitHub repository named Baifron provides proof-of-concept code to defeat Byfron's process protection mechanisms. The included PlagueSuspender tool suspends threads responsible for process scanning, allowing debuggers like IDA and x64dbg to attach without crashing the protected application. This demonstrates a specific method to bypass Byfron's anti-tampering defenses.

Pentera researchers published a proof-of-concept demonstrating three reflective loading techniques to evade Endpoint Detection and Response (EDR) systems. The methods include DLL forwarding to bypass EDR hooks, a framework for remote memory interactions, and a scripting language for efficient API interactions. These techniques allow payloads to execute in memory without leaving forensic traces, challenging endpoint security assumptions.

A proof-of-concept tool demonstrates how to disable Microsoft Defender's Tamper Protection and other components by abusing SYSTEM/TrustedInstaller privileges to delete the WdFilter altitude registry key, causing the kernel minidriver to unload. This blinds Microsoft Defender for Endpoint (MDE) telemetry and activity monitoring. The technique affects multiple Windows versions up to certain builds.

CVE-2024-4332 is an authentication bypass vulnerability in Tripwire Enterprise 9.1.0 REST and SOAP APIs when LDAP/AD SAML authentication and auto-synchronization are enabled. It allows remote attackers with a valid username to gain privileged API access without credentials. This can lead to unauthorized information disclosure or modification, potentially compromising the security monitoring infrastructure.