Aikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
summary
Claim: an unprivileged process can force trusted EDR agents to delete arbitrary system files by combining junctions and handle catching with 0-day flaws, then overwrite free space to turn deletions into irrecoverable wipes. Implementation: PoC tool Aikido Wiper exploits MOVEFILE_DELAY_UNTIL_REBOOT behavior (MOVEFILE_DELAY_UNTIL_REBOOT) and vulnerabilities in six products (Defender/Defender for Endpoint, SentinelOne, TrendMicro Apex One, Avast/AVG). Results: four distinct bugs, three CVEs issued, SentinelOne declined a CVE, demos make Windows unbootable and fully remove an admin profile.
AI-written summary · about
chapters (19)
- 0:00Start
- 2:12What is a wiper?
- 2:52Why are wipers used?
- 5:49File Overwrite
- 7:05Drive Destruction
- 8:17Wiper Techniques
- 16:02Failed Attempts
- 17:40Creating a New Window of Opportunity
- 19:19Deleting a File After Reboot 2 methods
- 19:48Windows API Mark for Deletion Mechanism
- 21:01The Complete Process
- 22:42Arbitrary Deletion 6 Vulnerable Products
- 24:10Windows Defender Drivers Deletion Demo
- 26:31Ransomware Protection Feature Bypass
- 28:12Akido Wiper: The next gen wiper
- 28:24Makes the system unbootable
- 29:09Wipes important data
- 31:15Aikido Wiper GitHub
- 33:38Takeaways
related talks
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
39mEDR = Erase Data Remotely, By Cooking An Unforgettable (Byte) Signature Dish
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
39mWindows Agentless C2: (Ab)using the MDM Client Stack
29mRendering Ransomware Detection and EDR Products Blind
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
40mIn NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass