PlagueScanner - An Open Source Multiple AV Scanner Framework
Open source framework for multiple antivirus scanning, covering architecture, development lessons, features, and issues. Includes live demo and discussion on threat connectivity.
Malicious Office Doc Analysis for Everyone
Explore techniques for analyzing malicious Office documents, from initial triage to static analysis. Learn precautions, tools, and strategies for effective malware investigation.
Catch Me If You Can - A Decade of Evasive Malware Attack and Defense
Comprehensive survey of evasive malware techniques, detection methods, and mitigation strategies over the past decade, exploring the ongoing battle between malicious actors and automated analysis systems.
Lost in the Loader - The Many Faces of the Windows PE File Format
Explore Windows PE file format intricacies, parser differentials, and a custom language for modeling loaders. Learn analysis techniques to aid reverse-engineering tasks.
Generating YARA Rules by Classifying Malicious Byte Sequences
Explore an interpretable ML model for generating optimized malware detection signatures, balancing high detection rates with minimal false positives in ELF executables.
The Hunt for Major League IoT-ICS Threats - A Deep Dive into IoT Threat Terrain
Explore IoT security threats, automated threat hunting techniques, and advanced analysis methods to protect against malicious actions targeting millions of connected devices.
Two Strategies for Supply Chain Attacks
Explore two supply chain attack strategies by BARIUM APT group, analyzing real-world cases and their tactics. Learn defensive measures against these sophisticated cyber threats.
HTTP Statuses as C2 Commands and Compromised TLS
Explore innovative malware techniques using HTTP statuses as C2 commands and compromising TLS encryption. Learn about COMPFun's evolution and its impact on cybersecurity.
FIDLing with Decompilers
Explore decompilation basics, popular tools, and the Hex-Rays Decompiler. Learn about FIDL, a new library simplifying decompiler API usage, with practical examples and demos.
Zen - A Complex Campaign of Harmful Android Apps
Explore Android malware techniques, from repackaging apps to sophisticated rooting trojans. Learn about click fraud, exploit bundling, and persistence mechanisms used by malicious actors.
Generic and Static Detection of Mobile Malware Using ML
Explore machine learning techniques for generic, static detection of mobile malware, focusing on Android but applicable to iOS. Learn about the research methodology, workflow, and results.
KLara - Your New Friend
Cloud-based Yara scanner for efficient malware detection. Scans large malware libraries at high speeds, enhancing threat intelligence and APT hunting capabilities. Open-source project with live demo.
A Deep Dive Into Malicious Documents
Comprehensive analysis of malicious Office documents, covering macro analysis, obfuscation techniques, shellcode execution, and OS X targeting. Equips attendees to handle various maldoc threats.
A Year in the Red
Explore advanced red team tactics, including domain fronting, ADFS attacks, and sandbox evasion. Gain insights into offensive and defensive strategies for the coming year.
Searching for a Needle in a Remote Haystack
Challenges in cyberattack investigation and a novel open-source solution for remote digital forensic analysis, featuring a live demo of analyzing a complex infection on a remote machine.
Kernel Exploit Hunting and Mitigation
Explore kernel exploit hunting and mitigation techniques, focusing on identifying and analyzing malware that leverages Windows kernel vulnerabilities for system compromise and evasion of security measures.
CyptoAPT - APT Attacks on Crypto Exchange Employees
Overview of recent APT attacks on cryptocurrency exchange employees, from spear phishing to Firefox 0-day exploit and malware stages. Compares perspectives of victim, attacker, and security team.
Study of Malware Obfuscation Techniques
Comprehensive analysis of malware obfuscation techniques, cataloging evasion methods used by malware authors and presenting findings from a study of 4 million samples to improve security tools and processes.
Hiding in Plain Sight - PhantomLance Comes into Play
Uncover the sophisticated PhantomLance Android spyware, its evolution, deployment tactics, and connections to other malware campaigns in this cybersecurity investigation presentation.
Zebrocy’s Multi-Language Malware Salad
Explore Zebrocy's unique APT tactics, multi-language malware, and evolving techniques in this cybersecurity analysis by Kaspersky's Kurt Baumgartner.
Tracking Internet Threats by Visualizing IP and DNS Data
Visualize IP and DNS data to track Internet threats using innovative techniques like particle physics models and network graphs for enhanced cybersecurity intelligence.