BitDefender

A new proof-of-concept tool named CLR-Unhook removes security product hooks from the nLoadImage function in clr.dll, restoring the original CLR behavior. This allows in-memory .NET assembly loads via Assembly.Load(byte[]) to execute without EDR inspection or scanning, bypassing products like CrowdStrike, Bitdefender, and SentinelOne.

Sophos X-Ops uncovered HeartCrypt, a packer-as-a-service derived from EDRKillShifter, being used by at least eight ransomware groups to disable EDR and AV products before deploying ransomware. The tool injects malicious code into signed executables and uses BYOVD to load a kernel driver that terminates security processes. This represents a significant escalation in ransomware tactics through cybercrime-as-a-service.

The Conti ransomware group leaked an internal ranking of endpoint detection and response (EDR) products based on their ease of bypass during real-world attacks. The list places Microsoft Defender for Endpoint, McAfee, and Webroot in the lowest tier, while CrowdStrike is ranked highest. The leak highlights that even top-tier EDRs can be evaded, especially when poorly configured, and underscores the importance of defense-in-depth and proper security tool configuration.

A new technique called SEGRUN uses exception handlers to bypass userland EDR hooks by corrupting the EDR DLL's memory permissions, triggering exceptions on trampoline access, and redirecting execution via ROP to skip monitoring code. This allows evasion of endpoint detection without disrupting the target process.

A red team article demonstrates bypassing signature-based detection in Windows Defender and Bitdefender by encrypting Meterpreter shellcode with XOR and executing it via a custom Go loader. The technique evades static signatures by obfuscating the payload, allowing execution on a live system. This highlights a common evasion method that relies on the absence of runtime behavioral detection.

BOAZ is a modular evasion framework that combines signature, heuristic, and behavioral bypass techniques to generate undetectable payloads. It was tested against 14 desktop AVs and 7 EDRs, including Sophos, Windows Defender, and ESET. The tool serves as both an evasion testing utility and a packer/obfuscator for researchers.

A proof-of-concept repository named DV_NEW combines multiple evasion techniques under the name Dirty Vanity to bypass endpoint detection and response (EDR) systems. It uses direct syscalls, dynamic syscall number resolution, and an egg-hunting technique to patch syscall instructions at runtime, evading user-mode hooks and static analysis. The author claims successful bypass of Bitdefender and Microsoft Defender for Endpoint.

CVE-2024-2224 is a critical path traversal vulnerability in the UpdateServer component of Bitdefender GravityZone. It allows remote unauthenticated attackers to execute arbitrary code on affected endpoint security products and the on-premises management console. The flaw stems from insufficient validation of file path inputs, enabling attackers to write malicious files outside restricted directories.

A new open-source evasion framework named HookChain has been published, designed to bypass Endpoint Detection and Response (EDR) solutions. It uses IAT hooking, dynamic system service number resolution, and indirect system calls to hide malicious payloads. The tool claims to evade detection by several major EDR products.

A video and Reddit post surfaced on May 28, 2023, showing an executable that allegedly disables tamper protection and terminates the on-premise agents of numerous endpoint security products. The tool claims to work against vendors including CrowdStrike, SentinelOne, Carbon Black, and Windows Defender. ThreatLocker notes that its application allowlisting would block such an unknown executable from running.