Week of December 2, 2024

A researcher used Generative AI to create a list of 256 words that replace traditional 256-bit encryption in shellcode, reducing its entropy from high (6.65) to low levels, thereby evading EDR entropy-based detection. The modified shellcode was also hidden past the end of the executable file, a technique not previously observed in the wild. This proof-of-concept demonstrates a novel AI-assisted method for bypassing endpoint security heuristics.

A researcher discovered a technique to bypass freeRASP Android runtime protections by hooking the System.exit method, which is called in all threat detection callbacks. This single hook neutralizes all freeRASP checks without needing to target individual obfuscated detection functions.

A proof-of-concept tool demonstrates using the Windows BootExecute registry key to run a native executable before security services start, allowing deletion of security product files with SYSTEM privileges. The technique requires administrative access and placement of the binary in System32. It highlights a persistent gap in early boot protection for endpoint security products.