Attacking & Abusing EDRs: Vulnerabilities Across the Attack Surface

Do you want to disable an EDR as a low-privileged user? Or crash the agent while it scans a file? Abuse a hidden global whitelist, or plant malware directly inside the incident response packages collected by the EDR (of course as an unauthenticated attacker)?

EDRs are trusted to protect endpoints, but they also introduce a massive, highly privileged attack surface. This talk is not about classic evasion or bypasses. Instead, we systematically analyzed different EDR components as targets for exploitable vulnerabilities.

We map out the Windows EDR attack surface across kernel drivers, inter-process communication (IPC), local scanning engines, and cloud APIs:

• Crashing Defender: Fuzzing Microsoft Defender’s emulation engine (mpengine.dll) to crash the scanner on demand. Real-world telemetry from our SOC clients show these crashes even occur randomly on live systems. Additionally, this contains a very interesting remote 0/1-click remote unsandboxed attack surface.
• Broken Agent-Cloud Authentication: Analyzing agent-to-cloud communication in Microsoft Defender for Endpoint and Palo Alto Cortex XDR revealed severe authentication flaws. An unauthenticated attacker can intercept commands destined for an agent without local host access, spoof host isolation status, or inject malicious payloads directly into collected IR forensic packages.
  In Cortex XDR it is possible to spoof telemetry and alert data from agents to the cloud without any effective authentication.
• Abusing Incident Response Features: Turning Cortex XDR’s Live Terminal feature into a fully functional, stealthy C2 channel.
• The Hidden Global Whitelist: Revealing a trivial-to-abuse global whitelist inside Cortex XDR that can be leveraged to disable most behavioral detection rules.
• Killing Agents: Weaponizing a single IPC bug class to permanently disable 8 out of 10 tested EDR agents upon reboot as a low-privileged user (affecting CVE-2024-5909, CVE-2024-20671, and others).

This talk shares our research journey, provides technical deep dives and exploit demos, and highlights unexplored avenues for future offensive research.