A new form of cyberattack has emerged, allowing attackers to bypass endpoint detection and response (EDR) systems while simultaneously operating through a standard user with limited privileges.
See also: Frederick Health hit by Ransomware attack
Bypassing the EDR system to carry out cyberattacks has traditionally required high levels of privilege, such as administrator rights or system-level access
This innovative approach exploits masquerading and path obfuscation techniques, disguising malicious payloads as legitimate processes. In this way, it manages to mislead both automated detection systems and human analysts, making detection extremely difficult.
According to Zero Salarium reports , logging process creation events is crucial for detecting potential threats. Tools like Sysmon provide detailed data about process execution, recording critical information such as Image, CommandLine, CurrentDirectory , and ParentProcessID .
See also: DevilTraff smishing tool enables massive cyberattacks
Analysts often focus on investigating suspicious processes, prioritizing their execution paths or file names as key indicators for analysis.
For example, a process running from C:\Program Files\Windows Defender\MsMpEng.exe may appear legitimate while a process from %TEMP%\SuperJuicy.exe will raise red flags.
EDR solutions rely on kernel-level protection to protect directories such as C:\Program Files.
Without administrator privileges, attackers cannot place payloads in these protected directories. However, this new cyberattack technique bypasses EDR restrictions by manipulating the file path itself.
See also: New Apple CPU side-channel attacks steal data
Cyberattacks are an ever-evolving threat in the digital world. Some of the most common techniques include phishing, in which attackers trick victims into revealing sensitive information through fraudulent emails or websites. Also, DDoS (Distributed Denial of Service) attacks aim to disrupt networks or systems by overloading them with false requests. Another common method is the use of malicious software, such as trojans and ransomware, which can steal data or block access to it until a ransom is paid. Understanding these techniques is crucial to strengthening cybersecurity and avoiding potential threats.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
