Duping AV with handles ENS 10.7

[sunshinebg]

Is this possible to bypass ENS protection?

https://skelsec.medium.com/duping-av-with-handles-537ef985eb03

[yaz]

Hi @sunshinebg 

Thanks for reaching out to community. 

This looks like we need to carry out investigation with our Engineering. 

Can you kindly open an SR with us and we can have this investigation checked out from our Engineering level?

[SStoychev]

This is not related to specific env.

How to open SR without current customer?

Any way to reach Engineering team?

[yaz]

Hi @SStoychev 

This has to go through Support channel. We will share details to Engineering and Development. 

[Daveb3d]

If you want to harden ENS against Minikatz, create an expert role that restricts memory reads against LSASS.  You will have to tune it a lot initially, but then you should be able to start blocking.  It will frustrate red teams,  I promise.   🙂

[sunshinebg]

Just receive an update from  McAfee PSIRT Team:

The Beta release of CTP you identified should offer some protection against this type of attack.  It is disabled by default.  We would have reached out to you next week once it had been in the field for a couple of weeks to ask you turn it on.  We don’t like to offer Beta releases as a possible solution to a vulnerability until we’ve seen results from the telemetry.