Signal Brief · Archived
Week of December 9, 2024
The Week's Public Record
Events
2024-12-13
research poc
PoC Uses PendingFileRenameOperations and Directory Junctions to Disable EDRFileRenameJunctionsEDRDisable
A proof-of-concept demonstrates using Windows PendingFileRenameOperations registry key combined with directory junctions to bypass anti-tampering and delete EDR binaries on reboot. The technique requires administrator privileges and targets endpoint security products that rely on kernel callbacks to protect their registry keys. This method evades detection by referencing the EDR binary through a junction path not monitored by the security product.
Every event in this brief is a record in ColdRecon's canonical set, drawn from public open-source reporting and linked to its source. This is the general, non-personalized signal — published 7 days after the fact. The live daily brief, written for your deals, is for cleared officers.