TOKYOCORE wiper clearing UEFI Secure Boot keys via PowerShell

Subhankar H@Andrewsec57

•updated Jul 27, 2026•10•0•14

Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.