A universal EDR bypass built in Windows 10

https://www.riskinsight-wavestone.com/en/2023/10/a-universal-edr-bypass-built-in-windows-10/

by aa_is_op • 3 years ago

52 45 3 years ago

riskinsight-wavestone.com

ShamelessC• 3 years ago

Okay I'll be the first to ask -

What the hell is EDR software?

breser• 3 years ago

Endpoint Detection and Response. Basically a new term for antivirus/antimalware but that reports back to defenders and helps them respond to malicious software that may be on the device.

ok1234562• 3 years ago

so it's malware.

waihtis2• 3 years ago

new term

friend, the current term is XDR (eXtended Detection and Response - although that was a year or two ago and might be old in the market by now!)

m-p-3• 3 years ago

Some EDR examples for those wondering

* CrowdStrike

* SentinelOne

* Heimdal

bigstrat2003• 3 years ago

I'm glad you asked, because I was baffled myself when I couldn't find a definition in the article.

RachelF• 3 years ago

Yes, in many ways it is not a well-written article for those outside the the field.

einpoklum3• 3 years ago

... a way for... processes to disable the generation of some security events... This technique could be used to evade EDR software

So, you can disable some event logging for your process in Windows. Wow, what a grand discovery.

Note also the wide use of boldface in the article. That just screams professionalism, doesn't it?

jewillco2• 3 years ago

An application reducing event logging to outside security software that is supposed to be monitoring it is bad.

einpoklum3• 3 years ago

It is bad - bad security practice to rely on voluntary app logging.

_23sd2• 3 years ago

The significant thing here is that the technique should interfere with data collected by all common EDR software, rather than requiring specific tailoring for each one like most EDR bypass tricks. I’m curious about why the API protections present in Windows 11 couldn’t be brought to Windows 10.

Multiple pieces of evidence show that Microsoft is aware of the weakness, but is not changing the API behavior retroactively on Windows 10, likely due to retro-compatibility issues.

If MS actually says that, it seems like a lame excuse.

badrabbit• 3 years ago

Not just a lame excuse but downright irresponsible and reckless. They should make the fix an opt-in registry flag controlled mitigation, similar to the PE signature bypass mitigation.

They want to profit off of vulnerabilities by forcing upgrades. They make great products but man do they play dirty. After azure ad was hackes they rebranded and still charge an arm and leg to access your own tenant's security logs (even if you pay for storage and traffic!).

taspeotis• 3 years ago

some of its features can be turned off by a process having the SeDebugPrivilege or SeTcbPrivilege privilege, which can be achieved by any elevated process.

Isn’t this being on the other side of the airtight hatchway?

peddling-brink• 3 years ago

In an absolute sense, sure. But turning off EDR allows more actions to be taken in the dark.

derelicta• 3 years ago

I wonder if some video games use EDR-like surveillance technics to prevent cheating.

A universal EDR bypass built in Windows 10

Related Stories