Staying Undetected Using the Windows Container Isolation Framework
Daniel Avinoam reverse engineers the Windows Containers minifilter driver, weaponizing native filesystem isolation to hide malicious files and evade EDR sensors.
Summary
The Native Architecture of Windows Containers
Introduced in Windows Server 2016, Windows Containers provide lightweight process-level and Hyper-V filesystem isolation using a built-in kernel minifilter driver.
Reverse Engineering the Container Minifilter Driver
Daniel Avinoam reverse engineers Microsoft's container storage driver, detailing how copy-on-write redirection transparently separates container file modifications from the host volume.
Weaponizing Container Isolation for EDR Evasion
Instead of attempting container escapes, an attacker can intentionally run implants inside a custom container context, blinding host-based EDR agents from observing file drop and execution events.
Releasing Open-Source Tooling and Defensive Strategies
Avinoam releases an open-source proof-of-concept tool demonstrating native container abuse and outlines telemetry signatures for security engineers to detect containerized evasion.
Related talks
Briefings·32 min
Kyle Avery
Engineers share architectures for fine-tuning open source language models to uncover zero-day vulnerabilities across binary targets.
Wild West Hackin' Fest·49 min
Presenters detail vulnerability discovery and exploitation in Roll for Stealth Intro to AV EDR Evasion | Mike Saunders | WWHF Deadwood 2022.
Main Stage·16 min
Valerio Alessandroni
Valerio Alessandroni demonstrates how remote access trojans abuse trusted Google Cloud services and APIs for stealthy C2 communication and proxy tunneling.