APTs Way - Evading Your EBNIDS
Explore advanced techniques for evading Emulation Based Network Intrusion Detection Systems (EBNIDS) in this Black Hat conference talk by Ali Abbasi and Jos Wetzels. Delve into the limitations of signature-based intrusion detection systems against sophisticated attackers and learn how EBNIDSes aim to address these shortcomings. Discover novel evasion methods targeting the pre-processing, emulation, and heuristic detection stages of EBNIDSes. Examine intrinsic and implementation limitations, including context-keyed payload encoding, random decryption algorithms, and fragmentation techniques. Gain insights into kernel32.dll resolution heuristic evasion, stack constructing shellcode, and anti-disassembly methods. Witness demonstrations of heuristics evasion and emulator detection, and understand the challenges posed by unsupported instructions in the context of advanced persistent threats (APTs) and government-sponsored attackers.