Week of June 16, 2025

Security researcher David Lee released a proof-of-concept tool called Signature Kid that spoofs digital signatures on PE files. The tool copies a valid signature from a signed file to an unsigned one and manipulates registry keys to bypass Windows signature validation. This allows attackers to load malicious DLLs into protected processes, evading EDR, anti-cheat, and kernel-mode callbacks.

A red team engagement demonstrated a multi-stage evasion chain against Cortex XDR, bypassing PowerShell execution policies, injecting a malicious .NET profiler via COM hooks, and disabling AMSI in memory without admin privileges. The attack went undetected by default Cortex XDR analytics, prompting a forensic report to the vendor and subsequent patching.

CVE-2025-30642 is a link following vulnerability in Trend Micro Deep Security Agent 20.0 that allows a local low-privileged attacker to cause a denial of service on Windows systems. The flaw stems from improper handling of symbolic links during privileged file operations, enabling service disruption without user interaction. This vulnerability affects agent availability and security monitoring capabilities.