tag: Edr-Evasion · 3 items
- Engineer — Learn: No patch or config change applies here — the attack requires a user to execute a fake installer. Worth understanding that WHCP-signed kernel drivers can be weaponized to blind EDR before a stealer runs, which has implications for defense-in-depth design (e.g., application allowlisting, restricting GitHub-sourced executables in managed environments).
- SOC/IR — Act: This campaign shows zero AV/EDR detections due to the signed driver kill-chain, making standard signature coverage unreliable; hunt for suspicious kernel driver loads coinciding with LastPass-themed installer execution and tune detections on processes attempting to terminate security tooling (EDR self-protection bypass behavior).
- Leader — Plan: If LastPass is in the enterprise toolset, issue an internal advisory directing users to install authenticator apps only from official vendor or app-store sources; this is a brand-abuse social-engineering vector that warrants a user-awareness communication this quarter rather than immediate escalation.
- Engineer — Learn: The BYOVD technique exploiting a vulnerable OPSWAT driver to kill security tools is a notable evasion class worth understanding, but current targeting is regionally focused on Cambodia with no enrichment signals (no KEV, no PoC, no high EPSS) to justify immediate action in most environments.
- SOC/IR — Plan: Build or tune detections for vulnerable OPSWAT driver loads and anomalous security-tool process terminations consistent with BYOVD; Spark RAT is open-source and signatures should be available to add to EDR and SIEM rule sets this quarter.
- Leader — Skip
- Engineer — Plan: Verify your EDR agent is configured to load and protect in Safe Mode, and audit whether bcdedit or safeboot registry keys can be modified by non-admin processes — most EDR platforms have a specific setting for this that is not always on by default.
- SOC/IR — Act: Hunt for bcdedit commands setting safeboot (T1562.001) and unexpected Safe Mode reboots in Windows event logs since Akira affiliates actively use this to blind EDR before data theft; tune alerts on bcdedit execution from unexpected parent processes.
- Leader — Learn: Akira affiliates are successfully exfiltrating data even when encryption fails, confirming that ransomware incidents now carry extortion risk independent of operational disruption — worth a note in the next risk-register review.