Contain Yourself: Staying Undetected Using the Windows Container Isolation Framework

Research presented on DEF CON 31 that demonstrates how the Windows containers isolation framework (wcifs.sys), which is loaded on every modern Windows system by default, can be abused to bypass EDR file system malware protection, file/folder write restrictions and I/O ETW log-based correlations.

bypass bypass edr con container containers def default def con def con 31 edr file file system folder framework isolation log malware netsec protection research restrictions system undetected windows windows container isolation framework windows system