Security Product Vulnerability Research

---
name: security-product-vulnerability-research
description: "Use when hunting new vulnerabilities in the latest stable enterprise security product: endpoint protection, EDR/XDR, antivirus, DLP, firewall/VPN, email/web gateway, SIEM/SOAR, scanner, sandbox, agent, management server, update engine, parser, kernel driver, or cloud connector. Maps hostile-content pipelines and management trust boundaries to RCE, privilege escalation, bypass, or fleet-wide com..."
version: 1.0.0
license: MIT
metadata:
  package: unleash-skills
  author: NetVar1337/unleash
  category: security
  upstream: C:\Users\Admin\.agents\skills\security-product-vulnerability-research\SKILL.md
---

> Bundled with Unleash skills pack. Source: C:\Users\Admin\.agents\skills\security-product-vulnerability-research\SKILL.md

# Security Product Vulnerability Research

## Priority Model

Highest-value targets:

1. unauthenticated management server or gateway RCE;
2. hostile content automatically parsed under high privilege;
3. agent-to-controller trust flaw enabling fleet compromise;
4. local low-privilege to SYSTEM/root through agent/service/driver;
5. scanner/detonation guest-to-host escape;
6. signed update or policy channel compromise;
7. durable protection bypass that affects widespread enterprise deployments.

The product's defensive purpose is not proof of scope; deployment and latest-stable evidence still apply.

## Phase 1: Version Every Moving Component

Record separately:

- product/UI version;
- platform/agent/service binaries;
- scanning engine and signatures/models;
- kernel driver/minifilter/eBPF module;
- management server and database/schema;
- gateway/appliance firmware;
- browser/email/network inspection engines;
- sandbox/detonation image;
- updater and package-signing metadata;
- cloud connector/API version and feature rollout;
- policy revision and protection mode.

Security products often update engines independently of monthly releases. Revalidate after engine and signature updates, not only product upgrades.

Completion criterion: vulnerable bytes and content versions are hash-identified.

## Phase 2: Map Hostile-Content Pipelines

Trace realistic hostile inputs:

```text
file/network/email/event/telemetry
 -> collection/interception
 -> decompression/unpacking
 -> metadata/ADS/cloud fetch
 -> parser/emulator/model
 -> quarantine/remediation/reporting
 -> cloud submission/cache
 -> management action/update
```

Inventory:

- archive, installer, document, script, media, font, executable, filesystem, and memory parsers;
- recursive extraction and nested-format limits;
- network protocol/TLS/content decoders;
- email attachment and URL analysis;
- cloud reputation/submission;
- quarantine, restore, rewrite, and cleanup;
- scan exclusions, passive/offline/safe modes;
- telemetry deserialization and management dashboards;
- remote response commands and agent jobs.

For every stage record process, token/user, sandbox, filesystem root, network access, and whether the input is automatically processed.

Completion criterion: attacker-controlled bytes map to every privileged parser and side effect.

## Phase 3: Split Research Tracks

### Parser and emulation RCE

- recursive containers and parser handoff disagreement;
- decompression bombs and integer/size limits;
- malformed PE/ELF/Mach-O, script, bytecode, and document structures;
- emulator/JIT instruction semantics;
- dynamic unpacking and memory scanning;
- metadata streams and remote-file behavior;
- model/native preprocessing boundaries.

Use benign canaries first, then coverage-guided and grammar-aware fuzzing against the real engine version.

### Remediation and filesystem logic

- validate/use identity across quarantine, restore, rewrite, and delete;
- reparse/symlink/hard-link/ADS/cloud-placeholder behavior;
- VSS/snapshot versus live object confusion;
- temporary directory and archive extraction;
- file locks, oplocks, rename/delete, and partial cleanup;
- low-privileged trigger when real-time protection appears disabled.

On Windows, load `windows-privileged-file-workflows`.

### Agent/service/driver boundary

- IOCTL/RPC/pipe/shared-memory ACLs;
- impersonation and client identity;
- trusted process/PID/image-path assumptions;
- kernel/user pointer and length handling;
- policy/config paths writable by users;
- update/install/uninstall repair operations;
- callback cancellation and service restart races.

### Management plane and fleet trust

- enrollment/bootstrap tokens;
- agent certificate validation and tenant binding;
- server commands, scripts, packages, and response actions;
- webhook/syslog/event deserialization;
- RBAC and cross-tenant object IDs;
- node/controller version skew;
- backup/import/restore of policy and configuration;
- gateway-to-cloud and agent-to-server authentication.

### Sandbox/detonation escape

- file transfer into analysis guest;
- emulator/VM device and agent channels;
- result parser and artifact extraction back to host;
- shared folders, clipboard-like channels, and network services;
- nested archive/path traversal into host collection directories.

Completion criterion: each track has independent hypotheses and instrumentation.

## Phase 4: Build Faithful Triggers

Prefer supported product interfaces:

- scan API or normal file access;
- SMTP/HTTP/ICAP/proxy ingestion;
- endpoint telemetry/event submission;
- management job or normal low-privilege client request;
- isolated mail/web gateway transaction;
- detonation submission API.

Record flags and mode. A hidden scan option may alter notifications or consolidation without changing backend reachability; test impact separately from user-visible alerts.

Do not disable safeguards merely to reach the parser unless the same path is enabled in real deployments.

## Phase 5: Reliability and Impact

For every finding determine:

- automatic versus user-triggered processing;
- pre-auth/remote/local reachability;
- service/driver/sandbox privilege;
- whether self-protection changes exploitability;
- fleet propagation through management features;
- fail-open/fail-closed behavior after DoS;
- persistence across reboot/update/policy refresh;
- visibility in local UI, logs, EDR console, and cloud telemetry;
- exact latest engine/platform versions affected.

A bypass must demonstrate a protection invariant failure, not merely a signature miss on modified malware. Prefer logic paths that defeat class-wide enforcement.

## Phase 6: High-Yield Differential Tests

Compare:

- base file versus ADS/metadata;
- local versus SMB/WebDAV/cloud/virtual disk;
- active, passive, disabled real-time, offline, and safe modes;
- endpoint versus Server product;
- standalone agent versus managed fleet;
- old/new engine with same signatures and same engine with old/new signatures;
- scan versus quarantine/remediation/restore;
- online versus VSS snapshot;
- clean install versus long-lived upgraded endpoint;
- controller and agent version skew.

## Phase 7: Variant Hunt

Search:

- all format handlers sharing decompression or metadata helpers;
- scan and remediation implementations of the same object;
- endpoint and gateway copies of the same engine;
- platform-specific backends;
- management commands sharing authorization middleware;
- offline and recovery versions lagging online fixes;
- old CVE fixes omitted from fallback/parser/plugin paths;
- fleet operations that trust signed outer packages but not inner content.

## Common Pitfalls

1. Recording only marketing product version.
2. Calling a signature evasion a vulnerability without invariant failure.
3. Testing only real-time scanning and ignoring remediation/update/offline paths.
4. Assuming self-protection blocks standard-user API access.
5. Ignoring management servers and fleet-wide blast radius.
6. Fuzzing extracted libraries with initialization unlike the shipped engine.
7. Treating a sandbox-process compromise as host escape.
8. Failing to retest after silent engine/signature updates.

## Verification Checklist

- [ ] Latest platform, engine, signatures/models, agent, driver, and server versions recorded
- [ ] Hostile-content and management pipelines mapped
- [ ] Effective privilege/sandbox recorded per stage
- [ ] Faithful normal trigger reaches vulnerable code
- [ ] Root cause is more than signature evasion
- [ ] Remote/local/authentication requirements proven
- [ ] Fleet and management blast radius assessed
- [ ] Mode, source, and component-version differentials tested
- [ ] Stable latest bytes still affected
- [ ] Novelty gate passes