Week of August 18, 2025

A researcher released DSEclipse, a proof-of-concept UEFI bootkit written in x64 assembly that patches Windows Driver Signature Enforcement (DSE) at boot to allow loading unsigned drivers. The bootkit is only 976 bytes, supports HVCI, and leaves minimal traces. This demonstrates a technique to bypass a key Windows security mechanism before the OS initializes.

A red teamer published a field guide describing a custom dropper that bypasses modern EDRs using direct syscalls, payload obfuscation, and ETW patching. The article details stealth techniques to avoid detection and leaves minimal forensic evidence. It serves as a proof-of-concept to challenge assumptions about EDR invulnerability.

A path traversal vulnerability (CVE-2025-36114) in IBM QRadar SOAR Plugin App versions 1.0.0 through 5.6.0 allows unauthenticated remote attackers to read arbitrary files on the server. The flaw stems from improper input validation of URL parameters, enabling directory traversal via sequences like '../'. This could expose sensitive data such as credentials and configuration files.

Researchers demonstrate how manipulating Windows Filtering Platform (WFP) rules can block an EDR's cloud communication or bypass its network isolation, effectively blinding the EDR. The technique exploits the hierarchical filter evaluation logic of WFP, which many EDRs rely on for traffic control. This can reduce detection and response capabilities when the EDR is disconnected from its cloud backend.