Главная
Study mode:
on
1
Intro
2
POWER OF THE ACADEMY
3
INITIAL INFECTION: BEAR TACTIC - MALICIOUS LNK
4
LNK FILE COMPONENTS
5
LNK FILE CONSTRUCTION
6
INITIAL INFECTION: PANDA TACTIC - MACRO DOCUMENT
7
PRIVILEGE ESCALATION: BEAR TACTIC - UACME #23
8
HIGH LEVEL EXPLANATION: USMDISM METHOD
9
PRIVILEGE ESCALATION: PANDA TACTIC - KERNEL O-DAY
10
CREDENTIAL THEFT: BEAR & PANDA - IT'S A TIE!
11
PERSISTENCE: BEAR TACTIC - WMI EVENT SUBSCRIPTION
12
WMI EVENT SUBSCRIPTION BREAKDOWN
13
PERSISTENCE: PANDA TACTIC - SERVICEDLL
14
REGISTERING THE SERVICE
15
COUNTERMEASURES
16
EXFILTRATION: PANDA TACTIC - DISGUISED RAR
Description:
Explore real-world case studies of advanced cyber intrusions in this 47-minute conference talk from RSA Conference. Delve into demos and mitigation strategies for high-profile hacks, including the Democratic National Committee breach, as presented by Dmitri Alperovitch, Co-Founder and CTO of CrowdStrike. Gain insights into the tradecraft of state-sponsored threat actors like Bears, Pandas, and Kittens. Learn about initial infection tactics using malicious LNK files and macro documents, privilege escalation techniques involving UACME and kernel exploits, credential theft methods, persistence mechanisms through WMI event subscriptions and service DLLs, and exfiltration strategies employing disguised RAR files. Understand the power of cyber threat intelligence and discover effective countermeasures to protect against sophisticated cyber attacks.

Hacking Exposed - Real-World Tradecraft of Bears, Pandas and Kittens

RSA Conference
Add to list
0:00 / 0:00