Главная
Study mode:
on
1
Whoami
2
Why care about WMI?
3
What is WMI
4
Where does WMI live?
5
Windows Sysinternals AutoRuns
6
Windows Sysinternals Sysmon
7
Do you have a tool that...
8
WMI PWNAGE TOOLS
9
Process Execution
10
Process Command Line tells all
11
WMI Activity
12
Authentication
13
Parent-Child Processes
14
Lateral Movement - Push Payloads
15
Remote WMI Execution
16
WMI Service Starting
17
Details - Sysmon is an option
18
Details - Windows Logging Service WLS
19
PowerShell
20
How do I Hunt for PS?
21
WMI Tools
22
WMIC Use
23
Hunting for WMI Pwnage
24
Recommendations
25
Monitor WMI
26
Conclusion
27
Additional Reading
28
Questions
Description:
Explore techniques for detecting WMI exploitation in this 51-minute conference talk from Derbycon 2018. Delve into the importance of WMI, its location within Windows systems, and essential tools like Windows Sysinternals AutoRuns and Sysmon. Learn about process execution, command line analysis, WMI activity monitoring, and authentication methods. Discover strategies for identifying lateral movement, remote WMI execution, and PowerShell usage. Gain insights into WMI tools, hunting techniques, and receive recommendations for effective WMI monitoring. Conclude with additional reading suggestions and a Q&A session to enhance your understanding of WMI exploitation detection.

Detecting WMI Exploitation

Add to list
0:00 / 0:00