Week of April 28, 2025

A vulnerability in Elastic Agent and Elastic Defend (formerly Elastic Endpoint Security) exposes sensitive API key information to local unauthorized actors. This could lead to loss of confidentiality and allow impersonation of the endpoint to the Elastic Stack. The issue was internally discovered by Elastic engineers with no evidence of exploitation.

A researcher developed a method to bypass EDR command-line logging by feeding commands to a PowerShell process via stdin instead of arguments. The technique hides executed commands from typical EDR process logs, though PowerShell script block logging may still capture activity. The method was confirmed against one major EDR product and may affect others.

A vulnerability in Symantec Endpoint Protection Windows Agent's ERASER Engine prior to version 119.1.7.8 allows an attacker to delete protected resources. This is an elevation of privilege issue that could undermine endpoint protection integrity.

A penetration tester found that a heavily obfuscated PowerShell RAT was consistently detected by an EDR, but a simple, clean Python socket-based RAT with basic persistence functions executed without triggering any alerts. The research highlights that modern EDRs may flag complex obfuscation techniques as suspicious behavior, while straightforward, non-obfuscated code can evade detection by appearing benign.

Commvault experienced a breach by a nation-state actor who exploited a zero-day vulnerability (CVE-2025-3928) in its Web Server software to plant webshells. The incident affected a small number of customers but did not compromise backup data. Commvault is working with cybersecurity firms and authorities, and CISA has added the CVE to its Known Exploited Vulnerabilities Catalog.