Week of April 7, 2025

A red team researcher details an updated defense evasion toolkit combining direct syscalls to bypass user-mode EDR hooking with static analysis evasion methods like API renaming, egg-hunting, and random instructions. The techniques aim to make both dynamic and on-disk detection harder for endpoint security products.

Secureworks (a Sophos company) disclosed and fixed a local privilege escalation vulnerability in the Debian package component of Taegis Endpoint Agent for Linux. The flaw allowed arbitrary code execution. Red Hat-based Linux systems using RPM packages were not affected.

A local privilege escalation vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows. A locally authenticated non-administrative user can escalate to NT AUTHORITY\SYSTEM by exploiting a privilege management flaw combined with a race condition. The vulnerability is rated MEDIUM severity and has no known in-the-wild exploitation.

CVE-2025-26678 is an improper access control vulnerability in Windows Defender Application Control (WDAC) on Windows 10 1809 and other versions. It allows a local attacker to bypass WDAC application whitelisting policies without user interaction or elevated privileges, potentially enabling execution of unauthorized code. This undermines a key endpoint security control, posing high risk to confidentiality, integrity, and availability.

The ToddyCat APT group exploited CVE-2024-11859, a DLL sideloading vulnerability in ESET's command-line scanner (ecls.exe), to execute malicious payloads under the guise of a trusted security process. The attack used a custom malware toolkit called TCESB, which leverages BYOVD and kernel tampering to disable security monitoring. ESET patched the vulnerability on January 21, 2025.