Week of May 12, 2025

A GitHub repository named 'Bypass-Protection0x00' was published, aggregating over 30 tools and techniques for evading endpoint security products. It includes proof-of-concept exploits, loaders, and utilities targeting EDR, AV, UEFI, and Windows protections. The collection is intended for security research but lowers the barrier for attackers to adopt advanced evasion methods.

A researcher demonstrates using the Microsoft-signed console debugger CDB to bypass AMSI, Constrained Language Mode (CLM), and ETW by scripting memory patches before PowerShell initializes. The technique forces AmsiScanBuffer to return E_INVALIDARG and manipulates SystemPolicy to return None, effectively disabling script scanning and logging. This matters because it uses a trusted, signed Microsoft tool, making it harder for EDRs to detect or block.

Researchers demonstrated a technique to bypass Windows Defender Application Control (WDAC) by exploiting vulnerabilities in trusted, signed Electron applications. The method leverages the V8 JavaScript engine to execute arbitrary code within a whitelisted process, evading WDAC policies. This poses a risk to high-assurance environments relying on WDAC as a core security control.

A code injection vulnerability in Palo Alto Networks Cortex XDR Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host OS. The issue affects Broker VM versions prior to 26.0.119 and has a CVSS-BT score of 2.6 (LOW). No exploitation has been observed in the wild.

Fortinet disclosed CVE-2025-32756, a critical stack-based overflow in multiple products allowing unauthenticated RCE, exploited in the wild on FortiVoice. Ivanti disclosed CVE-2025-4427 and CVE-2025-4428 in Endpoint Manager, which when chained enable unauthenticated RCE, with limited exploitation observed.

TrollAMSI2 is a proof-of-concept tool that bypasses PowerShell AMSI by byte-patching the AMSI initialization method in JIT-compiled code, then forcing an UnInit call to prevent proper re-initialization. It offers both a DLL method using HarmonyLib and a PowerShell one-liner, achieving zero detections on VirusTotal at the time of publication.

CVE-2025-26684 is a local privilege escalation vulnerability in Microsoft Defender for Endpoint for Linux. It arises from improper validation of file paths, allowing an attacker with existing high privileges to manipulate file operations and gain full control of the system. The vulnerability affects all versions prior to the patch.