Tamper-Protection Bypass × STRANGETRINITY EDR

Researchers leveraged a signed EDR binary (a new LOLBin) to invoke this command, bypassing the signature check and disabling the EDR.

The EDR's update process temporarily lifts self-protection to apply updates. The command 'StrangeTrinity.exe unshield_from_authorized_process' disables shields if the parent process is signed by the vendor. Researchers leveraged a signed EDR binary (a new LOLBin) to invoke this command, bypassing the signature check and disabling the EDR.

Monitor for execution of the EDR's own signed binaries with unusual command-line arguments (e.g., 'unshield_from_authorized_process') or parent-child process relationships where a signed EDR binary spawns another EDR component in a non-standard way. Mitigation: ensure update mechanisms require multi-factor integrity checks and restrict self-protection disable commands to strictly controlled, monitored update workflows.