Week of August 5, 2024

A security researcher demonstrates how attackers can enumerate and abuse antivirus/EDR exclusion paths, processes, and extensions to bypass detection. The technique leverages built-in exclusion features present in most endpoint security products, creating blind spots that allow malicious activity to go undetected. The research includes a proof-of-concept PowerShell script to enumerate exclusions from Windows Defender operational logs without administrative privileges.

A vulnerability in Palo Alto Networks Cortex XDR agent on Windows allows a low-privileged local user to disable the agent. This could be exploited by malware to evade detection and perform malicious activity. Patches are available in versions 7.9.102+, 8.1.2+, and 8.2.1+.

CVE-2024-36131 is an insecure deserialization vulnerability in Ivanti Endpoint Manager Mobile (EPMM) prior to version 12.1.0.1. An authenticated attacker can achieve remote code execution on the underlying OS, leading to full system compromise. The flaw allows crafted serialized objects to execute arbitrary commands.

CVE-2024-23456 is an authentication bypass vulnerability in Zscaler Client Connector for Windows that allows anti-tampering protection to be disabled without proper signature validation. The flaw, classified under CWE-347, enables remote attackers to circumvent endpoint security controls without authentication or user interaction. Affected versions prior to 4.2.0.190 should be updated to mitigate the risk.

Elastic Security Labs published research detailing multiple methods to bypass Windows Smart App Control and SmartScreen reputation-based protections. The techniques include signing malware with fraudulently obtained EV certificates, hijacking the reputation of trusted script hosts like Lua and AutoHotkey, and seeding new binaries to gain a benign reputation. These bypasses allow attackers to achieve initial access without triggering security warnings.

In July 2024, Rhysida ransomware group attacked a private school using a new Oyster Backdoor variant distributed through SEO poisoning and malvertising. The backdoor captured administrative credentials, allowing attackers to bypass ThreatDown Endpoint Protection and encrypt VMDK files on VMware hypervisors. The incident highlights the risk of relying solely on endpoint protection without EDR/MDR capabilities.