DLL Side-Loading × Xcitium OpenEDR

the driver does not verify the signature of the DLL it injects, and it searches for the DLL in an unprotected path (System32) before the protected installation path

The OpenEDR driver uses kernel callbacks to inject a hooking DLL (edrpm64.dll or edrpm32.dll) into new processes. The APC injection technique lacks signature verification, and the driver first looks for the DLL in System32, which is not protected against tampering. An attacker with high integrity can rename the original DLL and place a malicious one in System32; the driver then loads and injects the malicious DLL into all monitored processes.

Monitor for unexpected DLLs being loaded from System32 by the EDR's injection driver, especially if the DLL lacks a valid signature or has a recently changed hash. Mitigation: enforce driver signature verification for injected DLLs and restrict write access to the EDR's installation and DLL search paths to SYSTEM only.