Week of June 9, 2025

DefenderControlV2 is an open-source C++ tool that permanently disables Microsoft Defender by gaining TrustedInstaller privileges, stopping services, disabling tamper protection, and modifying registry and WMI settings. It is a fork of defender-control with improved error handling and additional features like removing Defender files and handling WdFilter. The tool is tested on Windows 10 22H2 and Windows 11 24H2.

A proof-of-concept adaptation of the EDRSilencer BOF tool has been released for the Sliver C2 framework. It uses Windows Filtering Platform (WFP) to block outbound network traffic from EDR and antivirus processes, preventing telemetry without terminating security software. This enables stealthier post-exploitation and C2 operations.

This article details a kernel-level technique to bypass Windows LSA Protection by directly manipulating the EPROCESS structure's Protection field using WinDbg or custom tools, allowing Mimikatz to dump credentials from LSASS. The method requires kernel access and demonstrates that LSA Protection is ineffective against attackers with such privileges. It serves as a proof-of-concept for red teams and highlights detection opportunities for blue teams.

A critical vulnerability in Tenable Agent on Windows allows a non-administrative local user to overwrite arbitrary system files with log content at SYSTEM privilege. This can lead to privilege escalation and full system compromise. Upgrading to version 10.8.5 resolves the issue.

A PowerShell script called MoveEDR was published that leverages the Windows PendingFileRenameOperations registry key to move or delete EDR files before they start, effectively disabling endpoint detection. It requires local administrator privileges and targets multiple EDR products, including CrowdStrike, Elastic, McAfee, Trellix, Trend Micro, and Windows Defender. The technique is a proof-of-concept demonstrating a built-in Windows mechanism to bypass tamper protection.

A researcher demonstrated that an attacker with local administrator privileges can use Windows Defender Application Control (WDAC) to create a deny rule for MsMpEng.exe, disabling Microsoft Defender's real-time protection even on Intune-managed endpoints with Defender for Endpoint. This bypass allows execution of tools like Mimikatz without detection.

The Stealth Falcon APT group exploited a zero-day remote code execution vulnerability (CVE-2025-33053) in Windows WebDAV to target a Turkish defense company. The attack used a malicious .url file to manipulate the working directory of a legitimate Windows diagnostic tool, causing it to execute malware from an attacker-controlled WebDAV server. The campaign deployed a custom implant called Horus Agent for reconnaissance and further payload delivery.

SentinelLABS reported that China-nexus threat actors conducted reconnaissance against SentinelOne's internet-facing servers and compromised a third-party IT logistics firm handling employee hardware. The attackers were unsuccessful in compromising SentinelOne itself. The campaigns, involving ShadowPad and PurpleHaze clusters, targeted over 70 organizations globally using techniques like DLL hijacking, obfuscation, and custom backdoors.