Evasion, Persistence, and Blinding EDR - Oh My

The talk begins with the origin of AutoPwnKey, a framework the presenters built after malware families moved from AutoIt to AutoHotkey. They explain why AutoHotkey is hard for endpoint tools to judge: its interpreter carries a valid signature, it can run portably in user context without installation, and its scripts look like ordinary automation. They also outline how EDR products hook functions in system DLLs and how removing those hooks from ntdll can hide calls from monitoring.

The middle of the session is a series of live demos. These cover agent-to-server command execution, PowerShell run through Winget, an ntdll unhook followed by bulk file encryption and decryption, RDP-based lateral movement, a keylogger module, a UAC bypass, and a weaponized Excel document. A domain enumeration module checks for unconstrained delegation. The presenters report that most tested products missed many of these actions, while one tested host was eventually detected and contained after an alert.

The closing section focuses on defense. AutoHotkey loads far more DLLs than a typical process, so import counts are a useful signal. The presenters recommend baselining where the tool is used, blocking the interpreter where it is not needed, writing custom indicators of attack, restricting sensor traffic with host firewall rules, and applying application control, since the framework needs no admin rights to run.