Главная
Study mode:
on
1
Intro
2
Sandbox Detection
3
Implant Security Repository
4
Sleeping
5
Sandbox evasion 101
6
Encryption
7
Ebola
8
Hyperion
9
Foot Delay Analysis
10
Running the Code
11
How it Works
12
Demo
13
Example
14
Building a profile
15
Process names
16
PowerShell example
17
Windows Updates
18
Registry Size
19
User Activity
20
Maskless
21
Python
22
PowerShell
23
Mouse Position
24
Lazy dll
25
Popup box
26
Popup box Ruby
27
Message box Ruby
28
Veil
29
Pull Request
30
Demo God
31
Flat payloads
32
User prompt
33
Check source code
34
Run code
Description:
Explore payload-agnostic sandbox detection techniques in this 40-minute conference talk from BSidesLV 2017. Delve into topics such as implant security, sandbox evasion strategies, and encryption methods like Ebola and Hyperion. Learn about foot delay analysis, process profiling, and various detection methods including registry size checks, user activity monitoring, and mouse position tracking. Discover practical implementations in Python, PowerShell, and Ruby, and examine tools like Veil for creating undetectable payloads. Gain insights into flat payload structures, user prompts, and source code analysis techniques to enhance your understanding of sandbox detection and evasion.

CheckPlease - Payload-Agnostic Sandbox Detection

BSidesLV
Add to list
0:00 / 0:00