Week of July 22, 2024

CrowdStrike disputes claims by Qihoo 360 that the Falcon sensor bug causing a global Windows BSOD incident is exploitable for privilege escalation or remote code execution. The bug is an out-of-bounds read due to a mismatch in expected inputs, and CrowdStrike states it does not allow arbitrary memory writes or control of program execution. The company cites multiple sensor protections that prevent tampering with channel files.

KnowBe4, a security awareness training vendor, hired a North Korean national using a stolen US identity and AI-enhanced photo. The employee attempted to load malware onto a company-issued Mac immediately upon receipt, but was detected and contained by KnowBe4's SOC before any data loss or compromise occurred.

A proof-of-concept tool named SyscallTempering demonstrates a technique to evade EDR detection by tampering with system call arguments. It uses hardware breakpoints and a vectored exception handler to replace spoofed arguments with real ones on unhooked syscalls, successfully launching a payload under Sophos EDR. The method improves upon prior syscall tampering research by randomly selecting benign, unhooked syscalls and spoofing up to 11 arguments.

A developer publicly released source code for a kernel-mode driver technique that reads and writes virtual memory using CR3 manipulation to bypass Easy Anti-Cheat (EAC) and BattlEye (BE). The code demonstrates a method to access game memory undetected, originally part of a private cheat. This release provides a ready-made bypass for cheat developers.

The BlackSuit ransomware group has evolved its tactics to evade endpoint security by disguising its payload as a legitimate Qihoo 360 antivirus file. This technique significantly lowers detection rates, as observed in VirusTotal scans. The ransomware also employs encoded strings, imported DLLs, and a mandatory ID argument to thwart analysis.