Week of June 24, 2024

Researchers released EDRPrison, a proof-of-concept tool that blocks EDR agent telemetry by intercepting and filtering packets with WinDivert. It improves upon the earlier EDRSilencer by correlating packets to EDR processes more efficiently, potentially evading detection. The technique highlights a method to silence EDR communications without process manipulation.

A proof-of-concept Xposed module named AppPealing was released on XDA Forums that disables Inka AppSealing, a mobile application security solution. The module can dump encrypted Dex files, disable cheat detection, and bypass root detection. The developer received a DMCA takedown notice from AppSealing, indicating the tool's effectiveness against their protections.

A remote code execution vulnerability exists in CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6. The flaw stems from insecure extraction of an archive obtained from the server, allowing an attacker who can modify the server archive to execute arbitrary code as administrator on the endpoint.

A security researcher demonstrates a technique to disable EDR systems by loading a custom signed minifilter driver that blocks access to EDR-related files, preventing EDR processes from starting. The method was tested against Microsoft Defender and Elastic EDR, allowing execution of tools like Mimikatz without detection.

A GitHub repository offers a tool and paid service to remove Google Play Protect's integrity verification (pairipcore) from Android APKs, allowing repackaged or modified apps to run without signature or integrity checks. The tool targets offline Unity games and other apps, bypassing Google's app protection mechanisms. This demonstrates a practical method to defeat Google Play Protect's endpoint security features on Android devices.

A red team article demonstrates bypassing signature-based detection in Windows Defender and Bitdefender by encrypting Meterpreter shellcode with XOR and executing it via a custom Go loader. The technique evades static signatures by obfuscating the payload, allowing execution on a live system. This highlights a common evasion method that relies on the absence of runtime behavioral detection.

A novel Android malware named Snowblind abuses the Linux kernel seccomp feature to bypass anti-tampering protections in apps. It repackages target apps to steal credentials and gain remote control via accessibility services, remaining invisible to users. The technique has been observed in the wild targeting a Southeast Asian customer of i-Sprint.