Week of October 6, 2025

Security researchers developed EDR-Redir, a proof-of-concept tool that bypasses endpoint detection and response (EDR) systems by exploiting Windows Bind Filter and Cloud Filter drivers. The technique redirects file system operations to evade EDR inspection, representing a significant advancement in evasion methods. This matters because it demonstrates a novel method to undermine EDR visibility without directly attacking the security agent.

Researchers discovered that Microsoft Defender for Endpoint's cloud backend does not validate authentication tokens on several endpoints, allowing an attacker with a machine ID and tenant ID to hijack incident response commands. This enables interception of commands like host isolation, spoofing of responses, and planting malicious files in investigation packages. Microsoft classified the issue as low severity and has not committed to a fix.

CrowdStrike disclosed two medium-severity vulnerabilities (CVE-2025-42701 and CVE-2025-42706) in its Falcon sensor for Windows that could allow an attacker with existing code execution to delete arbitrary files. The flaws are a TOCTOU race condition and a logic error in origin validation. Patches are available, and no exploitation has been detected.

A logic error in the CrowdStrike Falcon sensor for Windows allows an attacker with code execution on the host to delete arbitrary files. The vulnerability was responsibly disclosed via CrowdStrike's bug bounty program and has been patched in sensor version 7.24 and above. There is no evidence of exploitation in the wild.

CVE-2025-37728 is a vulnerability in a CrowdStrike connector where cached credentials are insufficiently protected. A malicious user with low privileges can access CrowdStrike credentials from another space by creating and running a connector in a space they have access to. This could lead to unauthorized access to CrowdStrike services.