Главная
Study mode:
on
1
Intro
2
ETW to the rescue
3
ETW visibility
4
ETW overview
5
What does an event look like?
6
How do you capture ETW events?
7
Real-time ETW solutions
8
krabset DNS lookup example
9
krabsetw PowerShell DLL load example
10
krabsetw PowerShell method example
11
krabsetw thread injection example
12
Forensic wishlist, revisited
13
Process Start
14
PowerShell DLL Loaded
15
Obfuscated PowerShell
16
Data Exfiltration
17
Malicious PowerShell
18
Remote Thread Injection
19
Event overload!
20
Reducing event volume
21
Types of signals
22
Techniques applied
23
Performance & Reliability
24
Tampering
25
How does the Red team do?
26
How can you use ETW in your environment?
27
What's next?
28
Questions?
Description:
Explore the power of Event Tracing for Windows (ETW) for detecting intrusions in this comprehensive conference talk from Derbycon 7. Dive into ETW's capabilities, including its visibility and overview, and learn how to capture and interpret ETW events. Discover real-time ETW solutions through practical examples using krabset, such as DNS lookups, PowerShell DLL loads, and thread injection detection. Revisit the forensic wishlist and examine various attack scenarios, including process starts, obfuscated PowerShell, and data exfiltration. Address challenges like event overload and learn techniques for reducing event volume and identifying different types of signals. Explore performance, reliability, and tampering concerns, and gain insights into how red teams operate. Conclude with practical advice on implementing ETW in your environment and a glimpse into future developments in this field.

Hidden Treasure - Detecting Intrusions with ETW

Add to list
0:00 / 0:00