Week of April 21, 2025

A proof-of-concept technique was published that bypasses the Windows Antimalware Scan Interface (AMSI) by using hardware breakpoints to modify AmsiScanBuffer behavior at runtime. The method avoids patching AMSI DLLs on disk and leverages CPU debug registers for stealthy memory modification. This demonstrates a novel evasion approach against endpoint security products relying on AMSI.

Morphisec investigated a healthcare ransomware incident involving Mimic version 7.5, where attackers used previously deployed Clipper malware for credential harvesting and reentry. The attackers employed RDP lateral movement, deployed tools like Mimikatz and Process Hacker, and exfiltrated data via Mega.nz before encrypting files.

A persistent denial of service vulnerability in the FireEye EDR agent (now Trellix) allows attackers to permanently disable tamper protection by sending a malformed event. The flaw persists across reboots, leaving endpoints unprotected. Mitigation requires applying vendor patches.

Security research demonstrates that attackers with administrative privileges can craft malicious Windows Defender Application Control (WDAC) policies to block EDR software from running, effectively disabling endpoint detection. The technique involves placing a custom policy file in the CodeIntegrity folder and rebooting, which can be scaled via Group Policy to affect entire domains. This highlights the need for proactive WDAC policy enforcement and layered defenses.

Sysdig TRT discovered a vulnerability in the Harden-Runner GitHub Action that allows bypassing its disable-sudo security mechanism. The issue arises because the runner user is a member of the docker group, granting root-equivalent access, which can be exploited to regain sudo privileges. The vulnerability is patched in the latest version.

A public GitHub repository provides a Python-based method to bypass libpairipcore, a security component used in Android applications for tamper and signature verification. The technique involves modifying the AndroidManifest.xml to replace a reference to the pairip application class and patching CRC32 checks. This allows attackers to repackage and tamper with protected apps, potentially evading integrity checks.