Week of December 23, 2024

Security researchers released Krueger, a proof-of-concept tool that leverages Windows Defender Application Control (WDAC) to prevent EDR agents from loading at boot. The technique requires administrator privileges and a reboot, deploying a custom WDAC policy that blocks EDR services and drivers. It does not exploit any vulnerability in specific EDR products.

A proof-of-concept technique named Hit-And-Run demonstrates how to execute system calls while evading EDR detection by combining Vectored Exception Handling (VEH) with call stack theft. The method sets hardware breakpoints to intercept execution and redirects it through a dummy function to create a legitimate-looking call stack, bypassing inline hooking and call stack analysis. This allows attackers to perform syscalls with attacker-defined parameters without triggering EDR alarms.