This article introduces a previously-unnamed class of Windows vulnerability that demonstrates the dangers of assumption and describes some unintended security consequences.

Introduction

Windows file sharing

Sharing enforcement

Authenticode

Code integrity

Incorrect assumptions

Page hashes

Attacking code integrity

Paging exploitation

New research

Planning the attack

Implementation and considerations

Exploit demo

Understanding these vulnerabilities

Affected Operations

What else could be vulnerable?

Don’t forget about user mode

MapViewOfFile

ReadFile

LoadLibrary

Stopping the exploit

End-user detection and mitigation

Disclosure

Fixing Code Integrity

Summary and conclusion

Introducing a New Vulnerability Class: False File Immutability

In this research publication, we'll learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper with Anti-Malware processes and other important security features.

Loading code into PPL processes

Exploitation

Mitigation

Comparing behavior

Conclusion

Inside Microsoft's plan to kill PPLFault

Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique whereby a threat actor brings a known-vulnerable signed driver alongside their malware, loads it into the kernel, then exploits it to perform some action within the kernel that they would not otherwise be able to do. Employed by advanced threat actors for over a decade, BYOVD is becoming increasingly common in ransomware and commodity malware.

Security boundaries

Exploiting vulnerabilities

Turnkey tooling

Discussion

Forget vulnerable drivers - Admin is all you need

We aim to out-innovate adversaries and maintain protections against the cutting edge of attacker tradecraft. With Elastic Security 8.8, we added new kernel call stack based detections which provide us with improved efficacy against in-memory threats.

Intro

Deep Visibility

New Rules

C2 Coverage

Resources

Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks

This article demonstrates a flaw that allows attackers to bypass a Windows security mechanism which protects anti-malware products from various forms of attack.

Protected Anti-Malware Services

Windows Tokens

Sandboxing Tokens

Accessing Tokens

The Attack

Demo

Defense

Sandboxing Antimalware Products for Fun and Profit

Let's discuss three benefits that Hardware Stack Protections brings beyond the intended exploit mitigation capability, and explain some limitations.

Finding Truth in the Shadows

作者

Gabriel Landau

文章

引入一个新的漏洞类别：虚假文件不可变性

微软计划终结 PPLFault 的内幕

忘记易受攻击的驱动程序 - 您只需要管理员权限

提高赌注：使用内核调用堆栈检测内存中的威胁

沙盒化反恶意软件产品以获得乐趣和利润

在阴影中寻找真相