Subverting Sysmon - Application of a Formalized Security Product Evasion Methodology
Explore a comprehensive methodology for subverting security products, focusing on Sysmon, in this Black Hat conference talk. Delve into the mindset of well-funded nation-state actors and their approach to holistically evading detection. Learn about the goals of evasive adversaries, detection and subversion methodologies, and the rationale behind targeting Sysmon specifically. Examine data collector subversion strategies and their application to Sysmon, including tool familiarization, data source resilience auditing, implementation analysis, and attack surface analysis. Gain insights into the engineering challenges faced by adversaries in subverting security solutions and the importance of understanding these techniques for improving defensive postures.