Freeze Drying for Capturing Environment-Sensitive Malware Alive
Innovative techniques for capturing and analyzing environment-sensitive malware through "freeze drying" and live process migration, enabling dynamic analysis of sophisticated threats like Citadel and ZeuS/GameOver.
Counterfeiting the Pipes with FakeNet 2.0
Explore network simulation for malware analysis using FakeNet 2.0. Learn to mimic protocols, configure settings, and capture network signatures efficiently in this hands-on workshop.
Certificate Bypass - Hiding and Executing Malware from a Digitally Signed Executable
Innovative technique for concealing malware within digitally signed files, evading detection by security solutions. Explores PE file structure, certificate table manipulation, and memory-based execution without disk writing.
Watching the Watchdog - Protecting Kerberos Authentication With Network Monitoring
Explore advanced Kerberos attack detection techniques and learn to protect Windows networks using network monitoring. Includes a novel "Diamond PAC" attack variant and the "Kerberos Leash" tool.
Slime - Automated Anti-Sandboxing Disarmament System
Automated system to disarm malware with anti-sandbox techniques, focusing on host-fingerprinting and general anti-sandboxing. Analyzes exit reasons and suggests suitable environments for dynamic analysis of evasive malware.
API Deobfuscator - Identifying Runtime-Obfuscated API Calls Via Memory Access Analysis
Unveils a resilient API deobfuscation technique using memory access analysis, overcoming limitations of pattern-based approaches to identify runtime-obfuscated API calls in malware and obfuscated code.
API Deobfuscator - Resolving Obfuscated API Functions in Modern Packers
Uncover obfuscated API functions in modern packers using memory access analysis and iterative run-until-API methods. Learn techniques to deobfuscate Themida 32/64 packed binaries for effective malware analysis.
Distributing the Reconstruction of High-Level Intermediate Representation
Explore distributed reverse engineering techniques using intermediate representation in a clustered environment to analyze malware, extract characteristics, and improve threat intelligence initiatives.
Feeding Gophers to Ghidra
Improve Golang binary analysis in Ghidra with Java-based scripts. Recover strings, functions, and types for efficient malware research and vulnerability detection.
No Easy Breach Challenges and Lessons from an Epic Investigation
Explore advanced attack techniques, stealthy network traffic, and lessons from a major cybersecurity investigation. Gain insights into evolving tactics and improving threat detection.
The Fox is in the Henhouse - Detecting a Breach Before the Damage is Done
Detect network breaches early using visibility tools, data analysis, and real-time decision-making. Learn to choose and integrate security solutions for proactive threat response.
At the Mountains of Malware - Lessons Learned from Analyzing Terabytes of Malware
Discover key insights from analyzing vast amounts of malware, uncovering patterns and strategies to enhance cybersecurity defenses and threat detection capabilities.
Exploring Emotet, An Elaborate Everyday Enigma
Dive into the intricacies of Emotet, the notorious and evolving malware family. Learn about its sophisticated operation, components, and the investigative techniques used to reverse engineer this digital threat.
Perfidious - Make PE Backdooring Great Again
Explore PErfidious, a Python tool for PE file manipulation and shellcode injection. Learn about its capabilities in bypassing endpoint detection systems and its potential as a modern PE file analysis library.
Activities of the Tick Cyber Espionage Group Over the Last 10 Years
Comprehensive analysis of the Tick cyber espionage group's decade-long activities, focusing on their tactics, malware, and impact on East Asian targets, particularly in Korea and Japan.
Chkrootkit - Eating APTs for Breakfast Since 1997
Explore Chkrootkit's 20-year journey in detecting rootkits and malware. Learn about its features, methods, and potential improvements in this informative security talk.
Profiling and Detecting All Things SSL with JA3
Explore SSL/TLS fingerprinting with JA3, learn its capabilities for detecting malware and C2 servers, and discover the new JA3S for server fingerprinting. Enhance your network security skills.
Defeating Sandbox Evasion
Explore techniques to overcome sandbox evasion methods used by malware, enhancing detection capabilities and improving cybersecurity defenses against sophisticated threats.
Challenges on Reversing Layered Malware
Explora los desafíos de la ingeniería inversa de malware en capas, analizando técnicas avanzadas para descifrar y comprender el funcionamiento de software malicioso complejo.
IoT Malware - Comprehensive Survey, Analysis Framework and Case Studies
Comprehensive survey and analysis framework for IoT malware, featuring case studies. Explores latest research and practices in INFOSEC, focusing on emerging threats in Internet of Things devices.
MTV Reboot - My Super Sweet 16-Bit Malware - MS-DOS Edition - TSR Remix
Deep-dive analysis of MS-DOS malware, exploring infection techniques, stealth mechanisms, and persistence methods. Highlights technical complexity and graphical displays in 16-bit DOS malware through reverse-engineering.