Their demo was about 2 hours long, during it I’ve written my own ransomware in a few lines.
It used cipher.exe a command line utility that allows you to encrypt files, with about 5 lines of a batch script (well it was pinvoke in my case) I had a ransomware that would encrypt all document files in the user’s home directory with a new EFS cert, generate an EFS recovery agent and upload it to a webdav share, delete the EFS certificate from the system, then using the same cipher.exe utility secure wipe option (/w) nuke the file system and overwrite all deleted data to make both forensics and recovery near impossible.
Since cipher.exe is a signed Microsoft executable it wasn’t detected.
Their response was that they haven’t seen malware use this before and they were looking for windows crypto API calls, CPU metrics and other nonsense and assured us that it’s highly unlikely that anyone would use built-in command line utilities when compromising our network.