Cybersecurity researchers have demonstrated that by crafting malicious XML files with manipulated metadata, such as author tags filled with oversized buffers, attackers can poison task event logs and even overflow security logs like Security.evtx. These techniques allow attackers to cover their tracks by overwriting logs, making detection difficult. Critical Windows TaskManager involving schtasks.exe binary, which could enable malicious actors to execute commands with SYSTEM-level privileges, bypassing User Account Control (UAC) prompts and erasing audit logs. By exploiting RPC interfaces, malicious actors can inject poisoned XML data into task logs, overwrite audit trails, and even corrupt entire security logs, effectively erasing evidence of malicious activities. Typically, creating a scheduled task with a password (Batch Logon) requires explicit credentials, but attackers can exploit this process to elevate their privileges without user approval. However, Cymulate researchers have identified multiple vulnerabilities that can be exploited to bypass security controls and gain SYSTEM privileges.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 18:05:09 +0000