Week of October 28, 2024

A proof-of-concept technique demonstrates active call stack spoofing to deceive EDR products by fabricating legitimate call stacks during API calls like NtOpenProcess. The method exploits kernel callbacks that execute in the context of the calling thread, allowing an attacker to mask malicious activity such as credential theft from LSASS. This differs from prior dormant thread spoofing by actively manipulating call stacks for specific TTPs.

During an extortion incident investigation, Unit 42 discovered a threat actor testing an AV/EDR bypass tool against Cortex XDR on a rogue virtual system. The tool, based on EDRSandBlast, uses a vulnerable driver to unhook user-mode and kernel-mode callbacks. The actor's testing inadvertently exposed their toolkit and led to identification of the seller on cybercrime forums.

A publicly released proof-of-concept tool, ApplockerBypassExternalBinary, demonstrates how to bypass AppLocker and EDR hooks by reflectively loading arbitrary binaries using the InstallUtil LOLBAS. The tool is a fork of SharpReflectivePEInjection, modified to integrate InstallUtil for execution, and includes basic antivirus evasion techniques. It was demonstrated with Ligolo-ng but can be adapted to run any binary.

A proof-of-concept exploit demonstrates bypassing Skyhigh Client Proxy policy enforcement via named pipe injection. The PoC injects shellcode into a user-run SCPBypass.exe process to write to the SCPService.exe pipe, circumventing WGUARDNT checks. This allows a malicious insider to disable web filtering without a valid release code.