Week of August 12, 2024

DseDisabler is a proof-of-concept tool that disables Windows Driver Signature Enforcement (DSE) by patching the g_CiOptions variable in the kernel. It uses a ring0 driver without IOCTL communication and supports manual mapping. The tool bypasses PatchGuard protection on CI.dll by suggesting methods like loading NoBsodDriver or using EfiGuard.

PandaLoader is a publicly available proof-of-concept shellcode loader written in C++ that employs multiple evasion techniques to bypass antivirus and EDR detection. It uses XOR encryption, APC injection, ETW patching, and anti-VM checks to stealthily execute payloads. The tool includes a builder for custom payload generation and is intended for red team use.

The RansomHub ransomware group, tracked as Water Bakunawa, has integrated the EDRKillShifter tool into its attack chain to disable endpoint detection and response (EDR) and antivirus protections. EDRKillShifter exploits vulnerable drivers to terminate security processes, enhancing persistence and evasion. This technique was observed in a recent incident analyzed by Trend Micro, highlighting the group's evolving capabilities to bypass traditional endpoint defenses.

CVE-2024-7694 is an unrestricted file upload vulnerability in TeamT5 ThreatSonar Anti-Ransomware that allows remote attackers with administrator privileges to upload malicious files and execute arbitrary system commands on the server. It has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. The vulnerability has a CVSS 3.1 score of 7.2 (HIGH).