Week of November 25, 2024

A research blog post demonstrates a novel method to block EDR agent communication by manipulating the Windows Name Resolution Policy Table (NRPT). By adding NRPT rules that redirect DNS queries for EDR cloud endpoints to localhost, the agent is unable to resolve its required domains, effectively silencing it. The technique requires administrative privileges and is not limited to Microsoft Defender for Endpoint.

A technique was demonstrated to bypass EDR command-line logging by using the WSL2 API to launch Linux commands with redirected stdin, preventing EDR sensors from capturing the actual commands executed. This allows attackers to run arbitrary commands within WSL2 without detection, as only the initial 'sh' process is logged. The method leverages the lack of visibility into virtualized WSL2 environments by Windows EDR sensors.

A critical command injection vulnerability (CVE-2024-11482) in Trellix Enterprise Security Manager 11.6.10 allows unauthenticated remote attackers to execute arbitrary commands as root via the internal Snowservice API. The flaw stems from missing authentication and insufficient input sanitization. Exploitation could lead to full compromise of the security management appliance.

A new open-source tool named Cloakk demonstrates a stealthy AMSI bypass and fileless PowerShell execution technique. It patches AmsiScanBuffer and AmsiInitialize at runtime using indirect syscalls and executes XOR-encrypted PowerShell payloads in memory. The tool is intended for red team operations and security research.

A new technique called SEGRUN uses exception handlers to bypass userland EDR hooks by corrupting the EDR DLL's memory permissions, triggering exceptions on trampoline access, and redirecting execution via ROP to skip monitoring code. This allows evasion of endpoint detection without disrupting the target process.