Week of February 3, 2025

A proof-of-concept tool named CortexRansomBypass demonstrates a method to bypass Palo Alto Networks Cortex EDR ransomware protection. The repository includes C# code and links to a detailed blog post explaining the technique. This highlights a potential detection gap in Cortex's anti-ransomware capabilities.

A threat actor on the dark web claims to sell a tool that bypasses EDR solutions using advanced cryptographic techniques. The tool reportedly targets CrowdStrike, Sophos, SentinelOne, and FortiClient. This highlights the growing black market for EDR evasion tools.

A proof-of-concept Windows shellcode loader named BypassETWDirectSyscallShellcodeLoader was published on GitHub. It demonstrates ETW bypass by patching EtwEventWrite, anti-debugging/sandbox checks, dynamic API resolution, and process injection via direct syscalls. The tool is intended for security research and penetration testing.

A proof-of-concept demonstrates using null routing (route to 0.0.0.0) to block EDR telemetry by dropping outbound packets to EDR infrastructure IPs. This technique, similar to WFP-based EDRSilencer, prevents alerts from reaching security consoles without disabling the sensor, and was confirmed against multiple top-tier EDR products.

A novel attack technique allows a low-privileged standard user to bypass EDR detection by creating a spoofed directory path using Unicode whitespace characters that mimic legitimate security software paths. This masquerading method deceives both automated detection and human analysts, enabling malicious payloads to appear as trusted processes. The technique highlights a gap in endpoint monitoring that relies on process creation paths.

BeyondTrust disclosed a zero-day breach where attackers exploited a third-party application vulnerability to access an AWS asset containing an infrastructure API key. The key was used to reset local application passwords in 17 Remote Support SaaS instances. No ransomware or further unauthorized access was detected, and affected instances were quarantined and replaced.