Week of November 17, 2025

A technique named Fairy-Law enables the MicrosoftSignedOnly mitigation policy globally via registry modification, causing Windows to block loading of non-Microsoft-signed DLLs. This prevents many EDR agents from initializing after reboot, as their vendor-signed components are rejected. The method requires administrator privileges and a system restart.

A vulnerability in the Microsoft-signed elastic-endpoint-driver.sys allows a local attacker to trigger a NULL or invalid pointer dereference in a kernel free routine, causing a Blue Screen of Death (BSOD) and persistent denial of service. The flaw was used as part of a broader attack chain including EDR bypass, low-privilege RCE, and persistence. Elastic has disputed the vulnerability, and no CVE has been assigned.

A vulnerability in Wazuh Agent versions before 4.13.0 allows authenticated attackers to inject malicious UNC paths into agent configuration settings, forcing NTLM authentication. This can lead to NTLM relay attacks, privilege escalation, and remote code execution. A proof-of-concept exploit is publicly available, and a patch has been released in version 4.13.0.

A researcher demonstrates how running QEMU in user-mode emulation on Windows creates a blind spot for EDRs, as the security tools cannot inspect activity inside the emulated Linux environment. The technique allows undetected execution of tools and techniques within the VM, with only the QEMU process visible to the EDR. This bypass works without admin privileges when using NAT networking and software emulation.

A new proof-of-concept tool, SilentButDeadly, uses Windows Filtering Platform (WFP) dynamic sessions to block network communication of EDR and AV processes, neutralizing their cloud-dependent security functions. It requires administrator privileges and targets processes like SentinelOne and Windows Defender, preventing telemetry, updates, and remote management. The technique minimizes forensic artifacts by cleaning up filters on exit.