Breaking the Illusion: Bypassing Endpoint Security Controls

The talk challenges marketing that calls endpoint products tamperproof. The presenters, both adversary emulation staff at PayPal, treat endpoint defenses as a full stack. That includes agents such as Microsoft Defender and supporting tools like the Zscaler client, plus management pushes through Intune or SCCM. Their starting point was prior CVEs for each product.

The demonstrations began with Zscaler. Its uninstall protection could be skipped with built-in PowerShell and WMI commands, and deleting a stored password from the keychain made the uninstaller fail open. Other methods blocked agent traffic with a Windows filtering tool, looped a task kill against the tunnel process, edited proxy rules, or renamed a blocked tool to an allowed name. For Defender, the speakers silenced cloud telemetry, restored quarantined tools through the local console, and disabled scanning by changing permissions on definition folders or replacing a key DLL. They also showed retrieval of BitLocker recovery keys as a low-privileged user, disabling Mark of the Web, and deactivating backup systems through a vendor console.

Many of these issues have since been patched or need configuration changes. Zscaler fixed 14 of 17 reported issues, while Microsoft closed its reports noting that admin access allows more damage. The takeaways: treat local admin as full compromise, monitor for tampering with agent files and services, check for persistence such as local admin password changes and immutable flags, and confirm that controls fail closed.