Week of October 21, 2024

A proof-of-concept tool demonstrates using Windows API calls VirtualAlloc, CreateThread, and WaitForSingleObject to inject shellcode into process memory, evading file-based detection. The technique achieves a reverse shell without writing to disk, highlighting the need for memory-based and behavioral defenses.

Mandiant and Fortinet investigated mass exploitation of FortiManager appliances via CVE-2024-47575, a zero-day vulnerability allowing an unauthorized FortiManager device to execute arbitrary code on vulnerable FortiManager appliances. The threat actor UNC5820 exploited this flaw as early as June 2024 to stage and exfiltrate configuration data of managed FortiGate devices, including hashed passwords. No lateral movement or further compromise was observed at the time of analysis.

HarfangLab transitioned its EDR agent from Python to Rust to overcome performance limitations and enhance security. The move reduces RAM/CPU usage, eliminates memory corruption vulnerabilities, and improves compatibility with older operating systems. The Rust-based agent maintains sub-50ms response times and handles up to 500k events per minute.

An improper access control vulnerability (CWE-269) in Trend Micro Deep Security Agent 20 allows a local attacker with low-privileged code execution to escalate privileges. The flaw impacts confidentiality, integrity, and availability with a CVSS score of 7.8. A patch is available in version 20.0.1 or later.

A proof-of-concept kernel-mode bypass for Valve Anti-Cheat (VAC) was published on GitHub. It intercepts VAC syscalls via SSDT hooks or InfinityHook to spoof memory integrity checks, allowing unsigned DLL injection and game module patching without detection. The technique defeats VAC's external memory scanning and trust-factor checks.