NOTE: Some of the topics in this article are probably going to be a bit contentious, but part of the hope in publishing this article is to drive some additional discussion within the offensive security community Ransomware has become one of the most prevalent threats that companies face today. It [...]
| Date | August 3, 2024 H 09:00 |
|---|---|
| End | August 4, 2024 H 17:00 |
| Location | BlackHat USA |
| Address | Mandalay Bay / Las Vegas |
Click here to add this event to your google calendar
Windows presents a vast attack surface, providing the Blue Team with many detection opportunities. Students will learn about evading Blue Team hunters by first learning to build detections, then masking their signatures, and exploiting indicators to decrease detection probability. We will also explore the impact of migrating through different programming languages, such as C# and IronPython. By the end of the course, students will be equipped with the knowledge to obfuscate open-source tools without necessitating custom tooling for use across a diverse and dynamic operations environment.
This class will explore the theory behind malware obfuscation, starting with the Theory of Code Obfuscation and how it applies to Tactics, Techniques, and Procedures (TTPs) implemented by modern Advanced Persistent Threats (APTs). We will examine everything from standard variable obfuscation to control flow manipulation to data procedurization. Students will apply obfuscation theory to practical applications in hands-on labs throughout the course.
To achieve these goals, students will examine several advanced techniques such as API unhooking, code migration, and exploiting the human element of the Security Operations Center (SOC). By the end of this class, students will understand code obfuscation in the application of custom tools and how to leverage it to extend the useful life of tools.
