Rendering Ransomware Detection and EDR Products Blind
summary
Describes a concrete evasion called replace that uses DefineDosDevice to pass a symlink and cause the driver to return error code 33, making the operation succeed while detection hooks skip it. Demonstrates a GitHub POC and a test tool, shows bypasses of Windows CFA (Controlled Folder Access) and Symantec endpoint protection, encrypting four protected files and the hosts file in live VMs, and reports nine months of vendor disclosure before public release.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:53How ransomware operates
- 4:07Detection methods limitations
- 13:51WannaCry preventable failure
- 15:36Replace evasion technique
- 19:34Live demo Microsoft CFA bypass
- 22:31Live demo Symantec bypass
- 26:07Mitigation and disclosure
related talks
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
52mRansomware 101: Get Smart Understanding Real Attacks
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
40mRansomware: Creation, Detection, and Response
40mRansomware: New Recipe For An Old Dish
52mFlying Under the Radar - New Security Evasion Techniques
35mBreaking Endpoint Anti-Ransomware: Going... (Nishant Sharma, Vivek Ramachandran)
14mThe Conjuring: ransomware edition!!