Week of November 18, 2024

This article details detection strategies for two tools, EDR Silencer and EDRSandblast, which are actively used by ransomware groups to disable or modify endpoint security solutions. EDR Silencer uses Windows Filtering Platform (WFP) to block EDR communications, while EDRSandblast exploits vulnerable drivers to remove kernel callbacks from security products. The research highlights that T1562.001 (Disable or Modify Tools) is the most prevalent technique among top ransomware groups.

An unauthenticated XML External Entity (XXE) vulnerability exists in Ivanti Endpoint Manager's ProvisioningWebService. The flaw resides in the ImportXml function, which fails to disable external entity resolution, allowing attackers to read local files, perform SSRF, or cause denial of service. This vulnerability was disclosed via ZDI and analyzed by PwnFuzz.

A technique to disable EDR MiniFilter drivers by modifying their altitude in the registry, preventing kernel call interception after a reboot. Observed in the wild used by Qilin ransomware to evade detection. The method was tested against six EDR products, none of which flagged the registry change.

A new technique bypasses AMSI by modifying the 'AmsiScanBuffer' string in the .rdata section of CLR.DLL in memory, preventing the runtime from passing reflectively loaded .NET modules to the installed AV. This avoids detection of malicious .NET assemblies loaded via Assembly.Load(byte[]). The method exploits the 'fail open' behavior of the CLR loader when AMSI lookup fails.

A vulnerability in Opsview Monitor Agent 6.8 allows unauthenticated remote attackers to execute arbitrary commands on Windows systems. The agent runs as Local System and its NRPE handlers are insecurely configured to pass user-supplied arguments into PowerShell without sanitization. This enables command injection via command-line escape sequences.

A command injection vulnerability in Trend Micro Deep Security Agent version 20 allows authenticated attackers with low privileges to escalate privileges and execute arbitrary code. In domain environments, attackers with domain user privileges may remotely inject commands to other machines. The flaw resides in the manual scan command handling.