Главная
Study mode:
on
1
Intro
2
Overview
3
Why is memory hunting important
4
Attacker techniques
5
API
6
Post Breach Detection
7
Dotnet Reflection
8
Dotnet Reflection Script
9
Running the Script
10
Venting Sources
11
Microsoft Threat Intelligence
12
The Problem
13
CLR Hook
14
Conclusion
15
Questions
Description:
Explore techniques for detecting memory resident malware in this 27-minute conference talk from Derbycon 7. Learn about the importance of memory hunting, attacker techniques, and post-breach detection methods. Discover how to use .NET reflection for malware detection, including a demonstration of running a detection script. Examine the challenges of CLR hooking and gain insights from Microsoft Threat Intelligence. Conclude with a Q&A session to deepen your understanding of memory-based malware detection strategies.

Hunting for Memory Resident Malware

Add to list