Shmuel Cohen: Ciemna strona EDR: ponowne wykorzystanie EDR jako narzędzia ofensywnego | CONFidence

As EDR solutions have become an integral part of the cybersecurity landscape, operating on millions of endpoints and servers, their function in advanced threat detection is undisputed. However, with large power comes large responsibility, an incorrect deployment can lead to critical vulnerabilities, possibly exploited by malicious actors.

This investigation explores a distinctive approach, differentiating itself from prior studies and real-world attacks that aimed at bypassing, disabling, or removing EDR systems, all of which tend to be conspicuous and impractical for Advanced Persistent Threat (APT) campaigns.

Our methodology involves control over the EDR, enabling the execution of code within its context. This capability allows us to operate secretly and persistently, importantly impacting organizational safety postures.
Focusing on Palo Alto Networks Cortex XDR, we show not only the manipulation of the strategy to bypass safety measures but besides the transformation of the EDR into a stealthy and uniquely persistent form of malware. Our investigation goes beyond the limitations of existing attacks, which are frequently besides conspicuous for APT campaigns.

We successfully bypassed crucial safety features implemented by the Cortex XDR, including device learning detection modules, evasion of behavioral modules, real-time prevention rules, and overcoming filter-driver protection against file modification.

The depth of our exploration encompasses exfiltration of delicate user credentials, establishment of persistence on the targeted system, encryption of the full device (FUD), complete LSASS memory dumping, concealing malicious activity notifications, bypassing the XDR admin password, and exploiting XDR comprehensively for malicious endeavors.
Notably, our persistence is so robust that it necessitates physical access to infected machines, as the XDR cannot be removed remotely from the management interface.

Join us as we delve into the implications of this fresh attack vector, shedding light on the intricate relation between attackers and XDR, and addressing a crucial aspect of EDR safety that has hitherto remained unexplored.

More: https://confidence-conference.org/