Week of October 27, 2025

A new technique, EDR-Redir V2, leverages Windows bind links to redirect the parent folder (e.g., Program Files) of an EDR's operating directory, bypassing folder protections. This allows an attacker to perform DLL hijacking by placing malicious files in a controlled location that the EDR sees as its parent. The method was demonstrated against Windows Defender on Windows 11 and is expected to work against many EDR solutions.

A vulnerability in the Safetica DLP kernel driver (ProcessMonitorDriver.sys) allows an attacker with administrator privileges to load the driver and send a crafted IOCTL to terminate arbitrary processes, including PPL-protected EDR/antivirus processes, from kernel context. This enables bypassing endpoint security and escalating to SYSTEM privileges. The issue is fixed in Safetica versions 11.26.19, 11.29.8, and 10.5.150.

Security researchers developed a proof-of-concept Linux rootkit named Singularity that bypasses Elastic Security's EDR detection. The rootkit uses multiple evasion techniques including string obfuscation, symbol name randomization, module fragmentation, and direct syscalls to avoid static and behavioral detection. This demonstrates weaknesses in current kernel-level threat detection methodologies.

CVE-2025-62792 is an out-of-bounds read vulnerability in Wazuh Manager versions prior to 4.12.0. A compromised agent can send a crafted message causing the manager to read beyond allocated buffer boundaries, potentially exposing sensitive memory contents. The flaw resides in improper NULL termination in OS_CleanMSG() leading to over-read in w_expression_match().

A vulnerability in the ThreatFire System Monitor kernel driver (TfSysMon.sys) allows unprivileged users to terminate protected processes, including EDR and anti-malware, with kernel privileges. The driver lacks proper access control, enabling BYOVD attacks and local denial of service. The vulnerable driver is not in Microsoft's blocklist and its signature remains valid.