Security Product Vulnerability Research

Bundled with Unleash skills pack. Source: C:\Users\Admin.agents\skills\security-product-vulnerability-research\SKILL.md

Security Product Vulnerability Research

Priority Model

Highest-value targets:

1. unauthenticated management server or gateway RCE;
2. hostile content automatically parsed under high privilege;
3. agent-to-controller trust flaw enabling fleet compromise;
4. local low-privilege to SYSTEM/root through agent/service/driver;
5. scanner/detonation guest-to-host escape;
6. signed update or policy channel compromise;
7. durable protection bypass that affects widespread enterprise deployments.

The product's defensive purpose is not proof of scope; deployment and latest-stable evidence still apply.

Phase 1: Version Every Moving Component

Record separately:

• product/UI version;
• platform/agent/service binaries;
• scanning engine and signatures/models;
• kernel driver/minifilter/eBPF module;
• management server and database/schema;
• gateway/appliance firmware;
• browser/email/network inspection engines;
• sandbox/detonation image;
• updater and package-signing metadata;
• cloud connector/API version and feature rollout;
• policy revision and protection mode.

Security products often update engines independently of monthly releases. Revalidate after engine and signature updates, not only product upgrades.

Completion criterion: vulnerable bytes and content versions are hash-identified.

Phase 2: Map Hostile-Content Pipelines

Trace realistic hostile inputs:

file/network/email/event/telemetry
 -> collection/interception
 -> decompression/unpacking
 -> metadata/ADS/cloud fetch
 -> parser/emulator/model
 -> quarantine/remediation/reporting
 -> cloud submission/cache
 -> management action/update

Inventory:

• archive, installer, document, script, media, font, executable, filesystem, and memory parsers;
• recursive extraction and nested-format limits;
• network protocol/TLS/content decoders;
• email attachment and URL analysis;
• cloud reputation/submission;
• quarantine, restore, rewrite, and cleanup;
• scan exclusions, passive/offline/safe modes;
• telemetry deserialization and management dashboards;
• remote response commands and agent jobs.

For every stage record process, token/user, sandbox, filesystem root, network access, and whether the input is automatically processed.

Completion criterion: attacker-controlled bytes map to every privileged parser and side effect.

Phase 3: Split Research Tracks

Parser and emulation RCE

• recursive containers and parser handoff disagreement;
• decompression bombs and integer/size limits;
• malformed PE/ELF/Mach-O, script, bytecode, and document structures;
• emulator/JIT instruction semantics;
• dynamic unpacking and memory scanning;
• metadata streams and remote-file behavior;
• model/native preprocessing boundaries.

Use benign canaries first, then coverage-guided and grammar-aware fuzzing against the real engine version.

Remediation and filesystem logic

• validate/use identity across quarantine, restore, rewrite, and delete;
• reparse/symlink/hard-link/ADS/cloud-placeholder behavior;
• VSS/snapshot versus live object confusion;
• temporary directory and archive extraction;
• file locks, oplocks, rename/delete, and partial cleanup;
• low-privileged trigger when real-time protection appears disabled.

On Windows, load windows-privileged-file-workflows.

Agent/service/driver boundary

• IOCTL/RPC/pipe/shared-memory ACLs;
• impersonation and client identity;
• trusted process/PID/image-path assumptions;
• kernel/user pointer and length handling;
• policy/config paths writable by users;
• update/install/uninstall repair operations;
• callback cancellation and service restart races.

Management plane and fleet trust

• enrollment/bootstrap tokens;
• agent certificate validation and tenant binding;
• server commands, scripts, packages, and response actions;
• webhook/syslog/event deserialization;
• RBAC and cross-tenant object IDs;
• node/controller version skew;
• backup/import/restore of policy and configuration;
• gateway-to-cloud and agent-to-server authentication.

Sandbox/detonation escape

• file transfer into analysis guest;
• emulator/VM device and agent channels;
• result parser and artifact extraction back to host;
• shared folders, clipboard-like channels, and network services;
• nested archive/path traversal into host collection directories.

Completion criterion: each track has independent hypotheses and instrumentation.

Phase 4: Build Faithful Triggers

Prefer supported product interfaces:

• scan API or normal file access;
• SMTP/HTTP/ICAP/proxy ingestion;
• endpoint telemetry/event submission;
• management job or normal low-privilege client request;
• isolated mail/web gateway transaction;
• detonation submission API.

Record flags and mode. A hidden scan option may alter notifications or consolidation without changing backend reachability; test impact separately from user-visible alerts.

Do not disable safeguards merely to reach the parser unless the same path is enabled in real deployments.

Phase 5: Reliability and Impact

For every finding determine:

• automatic versus user-triggered processing;
• pre-auth/remote/local reachability;
• service/driver/sandbox privilege;
• whether self-protection changes exploitability;
• fleet propagation through management features;
• fail-open/fail-closed behavior after DoS;
• persistence across reboot/update/policy refresh;
• visibility in local UI, logs, EDR console, and cloud telemetry;
• exact latest engine/platform versions affected.

A bypass must demonstrate a protection invariant failure, not merely a signature miss on modified malware. Prefer logic paths that defeat class-wide enforcement.

Phase 6: High-Yield Differential Tests

Compare:

• base file versus ADS/metadata;
• local versus SMB/WebDAV/cloud/virtual disk;
• active, passive, disabled real-time, offline, and safe modes;
• endpoint versus Server product;
• standalone agent versus managed fleet;
• old/new engine with same signatures and same engine with old/new signatures;
• scan versus quarantine/remediation/restore;
• online versus VSS snapshot;
• clean install versus long-lived upgraded endpoint;
• controller and agent version skew.

Phase 7: Variant Hunt

Search:

• all format handlers sharing decompression or metadata helpers;
• scan and remediation implementations of the same object;
• endpoint and gateway copies of the same engine;
• platform-specific backends;
• management commands sharing authorization middleware;
• offline and recovery versions lagging online fixes;
• old CVE fixes omitted from fallback/parser/plugin paths;
• fleet operations that trust signed outer packages but not inner content.

Common Pitfalls

1. Recording only marketing product version.
2. Calling a signature evasion a vulnerability without invariant failure.
3. Testing only real-time scanning and ignoring remediation/update/offline paths.
4. Assuming self-protection blocks standard-user API access.
5. Ignoring management servers and fleet-wide blast radius.
6. Fuzzing extracted libraries with initialization unlike the shipped engine.
7. Treating a sandbox-process compromise as host escape.
8. Failing to retest after silent engine/signature updates.

Verification Checklist

• Latest platform, engine, signatures/models, agent, driver, and server versions recorded
• Hostile-content and management pipelines mapped
• Effective privilege/sandbox recorded per stage
• Faithful normal trigger reaches vulnerable code
• Root cause is more than signature evasion
• Remote/local/authentication requirements proven
• Fleet and management blast radius assessed
• Mode, source, and component-version differentials tested
• Stable latest bytes still affected
• Novelty gate passes