tag: Byovd · 5 items
- Engineer — Learn: The BYOVD technique abusing a legitimate AMD driver to blind security tooling is worth noting for driver allowlist/blocklist hardening, but no KEV, PoC, or broad enterprise targeting signal means no immediate patching action is required.
- SOC/IR — Plan: The four-stage chain—fake CAPTCHA ClickFix lure → PowerShell execution → vulnerable driver sideload → credential harvest—offers multiple detection opportunities; build or tune rules for ClickFix-style CAPTCHA-triggered script execution and for anomalous signed-driver loads that precede EDR tampering events.
- Leader — Skip
- Engineer — Learn: No patch or config change applies here — the attack requires a user to execute a fake installer. Worth understanding that WHCP-signed kernel drivers can be weaponized to blind EDR before a stealer runs, which has implications for defense-in-depth design (e.g., application allowlisting, restricting GitHub-sourced executables in managed environments).
- SOC/IR — Act: This campaign shows zero AV/EDR detections due to the signed driver kill-chain, making standard signature coverage unreliable; hunt for suspicious kernel driver loads coinciding with LastPass-themed installer execution and tune detections on processes attempting to terminate security tooling (EDR self-protection bypass behavior).
- Leader — Plan: If LastPass is in the enterprise toolset, issue an internal advisory directing users to install authenticator apps only from official vendor or app-store sources; this is a brand-abuse social-engineering vector that warrants a user-awareness communication this quarter rather than immediate escalation.
- Engineer — Learn: The BYOVD technique exploiting a vulnerable OPSWAT driver to kill security tools is a notable evasion class worth understanding, but current targeting is regionally focused on Cambodia with no enrichment signals (no KEV, no PoC, no high EPSS) to justify immediate action in most environments.
- SOC/IR — Plan: Build or tune detections for vulnerable OPSWAT driver loads and anomalous security-tool process terminations consistent with BYOVD; Spark RAT is open-source and signatures should be available to add to EDR and SIEM rule sets this quarter.
- Leader — Skip
- Engineer — Learn: Gogs 10.0 RCE and n8n workflow-to-RCE are worth tracking if you run either tool, but no enrichment signals (no KEV, PoC, or EPSS) are present and the summary is too thin to drive patching prioritization; read the underlying advisories directly for specifics.
- SOC/IR — Learn: The roundup references signed-driver abuse against defenses (BYOVD pattern) and legitimate-app blending techniques, but supplies no IOCs, ATT&CK mappings, or detection guidance — useful for threat-landscape awareness only.
- Leader — Skip
- Engineer — Learn: BYOVD and Process Ghosting are sophisticated defense-evasion techniques that challenge standard EDR assumptions; no patch action available, but useful for evaluating EDR coverage and hardening kernel driver allow-listing policies.
- SOC/IR — Plan: Multiple unrelated threat clusters adopting Cruciferra makes this detection-relevant — build or tune detections for known vulnerable driver loads (BYOVD) and process ghosting behaviors in your EDR; no IOCs surfaced yet so immediate hunting isn’t actionable.
- Leader — Skip