Blasting Event-Driven Cornucopia - WMI-based User-Space Attacks Blind SIEMs and EDRs

Explore a cutting-edge Black Hat conference talk that delves into Windows Management Instrumentation (WMI) vulnerabilities and their impact on endpoint security products. Discover how security researchers have uncovered new ways to exploit WMI, a mechanism that allows filtering without registering kernel callbacks, potentially blinding Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools. Learn about the researchers' previous work on disabling Event Tracing for Windows (ETW) and how their current focus on WMI exposes critical weaknesses in OS event monitoring approaches. Gain insights into the challenges faced by security solutions engineers in developing effective threat mitigation strategies for endpoints, especially when relying on built-in Windows mechanisms not originally designed with security as a primary concern.

Blasting Event-Driven Cornucopia: WMI-based User-Space Attacks Blind SIEMs and EDRs