Aikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
summary
Demonstrates a concrete exploit chain that lets an unprivileged account force privileged EDR/AV processes to delete arbitrary files by combining a held-open malicious file, MoveFileEx / MOVETO_REPLACE_ON_REBOOT behavior, and NTFS junction swapping before reboot; the chain can remove drivers and render Windows unbootable. Finds four zero-days across endpoint products, affecting six vulnerable products including Microsoft Defender, Defender for Endpoint, SentinelOne, Trend Micro, Avast and AVG, and tests 11 products with >50% vulnerable. The wiper then fills disk space to prevent recovery.
AI-written summary · about
chapters (15)
- 0:00Aikido research intro
- 1:04Wipers and their purpose
- 3:34Deletion vs wiping in Windows
- 7:49EDRs as malicious wipers
- 11:00TOCTOU flaws exploited
- 16:02Forcing EDRs to postpone deletions
- 18:31Combining deletion techniques
- 19:37Zero-day vulnerabilities found
- 21:25Demo: Windows Defender bypass
- 23:23Bypassing folder access control
- 25:09Aikido wiper tool intro
- 26:55Ensuring full data wipe
- 28:41Demo: Deleting admin directory
- 30:49Summary and security impact
- 32:15Vendor responses and conclusion
related talks
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
39mEDR = Erase Data Remotely, By Cooking An Unforgettable (Byte) Signature Dish
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
29mRendering Ransomware Detection and EDR Products Blind
40mIn NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
46mD2T2 - Over The Edge: Pwning The Windows Kernel