Главная
Study mode:
on
1
Intro
2
Advanced Persistent Threats (APTs) are Extremely Harmful
3
Existing Lateral Movement Technique
4
ShadowMove: a Novel Attack Technique
5
Case Study: Single Hop ShadowMove Over FTP
6
ShadowMove among Network Nodes
7
Threat Model
8
ShadowMove Architecture
9
Connection Detector
10
Conventional Socket Duplication
11
ShadowMove Socket Duplicator
12
Peer Handler
13
Lateral Movement Planner
14
Lateral Movement Plan Actuator
15
ShadowMove Implementation
16
ShadowMove PoC Leveraging WinRM (Windows Remote Management)
17
Evaluation of the Stealthiness
18
Limitations of the Current ShadowMove Prototype
19
Acknowledgement
Description:
Explore a novel attack technique called ShadowMove in this 51-minute conference talk by Associate Professor Jinpeng Wei from the University of North Carolina at Charlotte. Delve into the world of Advanced Persistent Threats (APTs) and learn how ShadowMove operates as a stealthy lateral movement strategy. Examine the threat model, architecture, and implementation of ShadowMove, including its components such as the Connection Detector, Socket Duplicator, Peer Handler, and Lateral Movement Planner. Analyze a case study of single-hop ShadowMove over FTP and understand how it moves among network nodes. Evaluate the stealthiness of this technique and discuss its current limitations. Gain insights into cybersecurity challenges and potential countermeasures against sophisticated attack strategies.

ShadowMove - A Stealthy Lateral Movement Strategy

CAE in Cybersecurity Community
Add to list