Week of March 3, 2025

SEC Consult discovered that CrowdStrike Falcon Sensor processes could be suspended by an attacker with SYSTEM privileges, allowing malicious applications to execute undetected. The vulnerability, named 'Sleeping Beauty', was initially dismissed by CrowdStrike as a detection gap but was silently patched by 2025. The bypass enabled tools like winPEAS, Rubeus, and Certipy to run unimpeded until the sensor was resumed.

The Akira ransomware gang used a vulnerable Linux-based webcam to encrypt network shares via SMB after their Windows encryptor was blocked by EDR. The webcam lacked an EDR agent and was not monitored, allowing the attack to succeed. This incident highlights the risk of unmanaged IoT devices on corporate networks.

Researchers demonstrate a technique where attackers with administrative privileges can leverage Windows Defender Application Control (WDAC) policies to block EDR agents from loading, effectively disabling endpoint detection. This method exploits the fact that WDAC policies can be configured to deny execution of specific binaries, including security software components. The technique highlights a potential blind spot in relying solely on built-in Windows security features for application control.

A red teamer demonstrated two techniques to evade CrowdStrike EDR: using the Pyramid framework to execute Sliver shellcode in Python's memory, and a custom Go binary to establish a reverse SSH tunnel for proxying post-exploitation tools. Both methods leverage trusted, legitimate tools to blend in and avoid detection.

Rubrik detected unauthorized access to a single logging server on February 22, 2025. The incident was contained to that server with no evidence of customer data or source code compromise. In response, Rubrik rotated authentication keys as a precaution.

A publicly released C++ utility named AMSIPatching patches AMSI functions in remote PowerShell processes, causing them to return E_INVALIDARG and effectively disabling AMSI-based malware scanning. The tool requires administrator privileges and works on both 32-bit and 64-bit processes. This demonstrates a specific technique to bypass endpoint security protections that rely on AMSI.