Week of December 15, 2025

A proof-of-concept tool named GhostLocker demonstrates using Windows AppLocker policies to block EDR userland executables from launching, effectively neutralizing detection capabilities. The technique leverages native administrative controls to create deny rules for security products, leaving kernel drivers active but unable to process telemetry without userland components. This research highlights a method for bypassing EDR without requiring kernel-level tampering.

Research demonstrates that macOS malware written in lesser-known languages like Nim, Rust, and Go can evade Endpoint Detection and Response (EDR) products. The evasion exploits gaps in static analysis, API hooking, and limited telemetry on macOS, allowing malicious code to bypass detection mechanisms.