Detecting and blocking unknown KnownDlls

The blog post explores a still-unpatched Windows privilege escalation vulnerability that allows attackers to execute highly privileged actions typically reserved for kernel drivers by exploiting the KnownDlls cache. The vulnerability involves a cache poisoning attack where attackers can add a DLL to the KnownDlls cache using a bug in the DefineDosDevice API, thereby bypassing security checks. The post details how to detect such attacks in real-time using a Windows driver and Elastic Endpoint Security, focusing on code integrity violations within Windows Protected Process Light (PPL). It introduces CI Spotter, a proof of concept tool that detects and prevents these attacks by terminating offending processes and highlights how Elastic Security can be configured to monitor and alert on these violations.