Главная
Study mode:
on
1
Intro
2
ETW to the rescue
3
ETW visibility
4
ETW overview
5
What does an event look like?
6
How do you capture ETW events?
7
Real-time ETW solutions
8
krabsetw DNS lookup example
9
krabsetw PowerShell DLL load example
10
krabsetw PowerShell command example
11
krabsetw thread injection example
12
Forensic wishlist, revisited
13
Process Start
14
PowerShell DLL Loaded
15
Obfuscated PowerShell
16
Data Exfiltration
17
Malicious PowerShell
18
Remote Thread Injection
19
Event overload!
20
Reducing event volume
21
Types of signals
22
Techniques applied
23
Performance & Reliability
24
Tampering
25
How does the Red team do?
26
How can you use ETW in your environment?
27
What's next?
28
Questions?
Description:
Explore the power of Event Tracing for Windows (ETW) for detecting intrusions in this comprehensive conference talk from GrrCON 2017. Dive into ETW's capabilities, including its visibility and overview, and learn how to capture and interpret ETW events. Discover real-time ETW solutions, with practical examples using krabsetw for DNS lookups, PowerShell DLL loading, command execution, and thread injection. Revisit the forensic wishlist, covering process starts, PowerShell activities, data exfiltration, and remote thread injection. Address challenges like event overload and learn techniques for reducing event volume and identifying different types of signals. Gain insights into performance, reliability, and tamper resistance of ETW-based solutions. Understand how red teams approach ETW and explore ways to implement ETW in your own environment. Conclude with a look at future developments and an opportunity for questions.

Hidden Treasure - Detecting Intrusions with ETW

Add to list
0:00 / 0:00