EDR = Erase Data Remotely, By Cooking An Unforgettable (Byte) Signature Dish
summary
Researchers disclose CVE-2023-24860 showing how minimal byte signatures can be implanted into log files, database fields, VM config and other writable data to trigger EDR byte-signature engines to automatically delete entire files or databases remotely. A blackbox pipeline uses a VirusTotal query (3,600 hits → ~130 unique signatures), an automated minimizer calling Defender scan functions and an attack database; seven demos and 10+ vectors include IIS/NGINX logs, MariaDB/MySQL/Postgres/SQLite/MongoDB, VMware vmdk/vmx, browser storage; claim of impacting ~35% web server logs and release of EDR-racer GitHub tool; Microsoft patches partly in April, Kaspersky remains unpatched.
AI-written summary · about
chapters (17)
- 0:00Introduction and goals
- 1:24The threat of EDR abuse
- 4:25Finding malicious signatures
- 9:14Automating signature search
- 11:54Testing on legit files
- 14:24Achieving remote attacks
- 16:18IIS log deletion demo
- 18:04Expanding to Linux EDR
- 20:11Linux log deletion demo
- 22:14More attack vectors
- 24:14Remote security log deletion
- 26:20SIEM database attacks
- 27:24Virtual machine attacks
- 30:52Production database deletion
- 33:42SQL database attack demo
- 35:33Browser and cloud attacks
- 37:15Conclusion and Q&A
related talks
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
29mRendering Ransomware Detection and EDR Products Blind
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
40mSomething Rotten in the State of Data Centers
52mFlying Under the Radar - New Security Evasion Techniques
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce