39 matches found
aegis
Aegis 内核模式进程保护驱动程序,使用 ObRegisterCallbacks 从句柄中剥离内存访问权限。基础实现拦截句柄创建,并从未经授权的访问尝试中移除 PROCESSVMREAD/WRITE/OPERATION。 注意: 如果 GIF 没有动画,请在 Imgur 上直接查看 概述 驱动在高度 321123 注册 OB 回调,拦截 OBOPERATIONHANDLECREATE 和 OBOPERATIONHANDLEDUPLICATE 操作。当进程尝试打开受保护目标的句柄时,我们根据白名单(explorer.exe, csrss.exe, svchost.exe,...
criPPLe
criPPLe Controlador de kernel de Windows que elimina la Protección de Procesos PP y la Protección de Procesos Light PPL. Esto fue creado con la ayuda del "Curso de Desarrollo de Controladores Ofensivos" de Zero-Point Security Este controlador de kernel elimina la protección de procesos de un pid...
PPEnum
PPEnum BOF simples para ler o nível de proteção de um processo...
BlockOpenHandle
BlockOpenHandle Blocca qualsiasi processo dall'apertura di un HANDLE al tuo processo; solo SYSTEM può aprire un handle al tuo processo, così puoi evitare gli scanner di memoria remoti POC...
EUVD-2026-60270
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-40145
A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...
CVE-2026-45206
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the abilit...
EUVD-2026-31279
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the abilit...
CVE-2026-45207
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the abilit...
CVE-2026-45206
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the abilit...
CVE-2026-34930
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism. Please note: an attacker must first obtain the ability to execute...
CVE-2026-34930
An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism. Please note: an attacker must first obtain the ability to execute...
throttlestop-poc
throttlestop-poc This is a simple Proof-of-Concept that abuses...
PT-2026-42469
Name of the Vulnerable Software and Affected Versions Apex One/SEP agent affected versions not specified Description An origin validation error in the process protection mechanism allows a local attacker to escalate privileges. To exploit this issue, the attacker must first have the ability to...
EUVD-2018-2497
Malware in sbrugna...
EUVD-2018-2786
Malware in sbrugna...
EUVD-2018-2809
Malware in sbrugna...
SUSE-SU-2025:03235-1 Security update for the Linux Kernel (Live Patch 9 for SLE 15 SP6)
This update for the Linux Kernel 6.4.0-1506002342 fixes several issues. The following security issues were fixed: - CVE-2025-38087: net/sched: fix use-after-free in tapriodevnotifier bsc1245504. - CVE-2025-21999: proc: fix UAF in procgetinode bsc1242579. - CVE-2025-38001: netsched: hfsc: Address...
Security update for kernel-livepatch-MICRO-6-0-RT_Update_6
This update for kernel-livepatch-MICRO-6-0-RTUpdate6 fixes the following issues: CVE-2025-38087: net/sched: fix use-after-free in tapriodevnotifier bsc1245505 CVE-2025-21999: proc: fix UAF in procgetinode bsc1242579 CVE-2025-38001: netsched: hfsc: Address reentrant enqueue adding class to eltree...
Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates
The threat actors behind the Medusa ransomware-as-a-service RaaS operation have been observed using a malicious driver dubbed ABYSSWORKER as part of a bring your own vulnerable driver BYOVD attack designed to disable anti-malware tools. Elastic Security Labs said it observed a Medusa ransomware...