TLDR Tech / InfoSec
Bring Your Own EDR: How to Turn a Commercial EDR into a Trojan Horse
Akamai researchers found that attackers with admin access on Windows can turn commercial EDR solutions, like SentinelOne, into a 'Trojan horse.' They demonstrated abusing EDR to dump protected processes, pivot to Microsoft Defender, and execute malicious code in a Protected Process Light (PPL) context. Further research showed attackers could temporarily disable EDR, inject malicious code into its protected files, execute it, and then re-enable EDR, effectively protecting the malware. Disabling cloud communication via local DNS modification was also demonstrated.
Read the full story