Blinding Endpoint Security Solutions - WMI Attack Vectors

Explore a groundbreaking conference talk on WMI attack vectors and their impact on endpoint security solutions. Delve into new research showcasing previously unseen attacks on WMI, involving both user and kernel mode vectors. Learn about WmiCheck, a novel security tool designed to detect various OS attacks, including those covered in this presentation. Gain insights from Claudiu Teodorescu, CTO and Co-founder of Binarly, as he discusses the weaknesses in WMI architecture and potential solutions for reliable OS event collection. Understand the critical importance of these attack vectors in disabling security solutions that rely on WMI telemetry, including EDR, AV, SIEM, and malware sandbox solutions.

Claudiu Teodorescu - Blinding Endpoint Security Solutions: WMI attack vectors - Ekoparty 2022