Explore advanced Windows Management Instrumentation (WMI) attacks, real-time defense strategies, and forensic analysis techniques in this comprehensive conference talk. Delve into PowerShell query language, instance queries, and event registration while learning about WMI's attack surface, reconnaissance methods, and code execution techniques. Gain insights into WMI providers, attack investigation, and reverse engineering processes. Discover effective detection mechanisms and understand the intricacies of Index BTRAMI warnings to enhance your cybersecurity skills and defend against sophisticated WMI-based threats.
Overview
Syllabus
Intro
What do you do next
Demo
Whats Next
Introduction
Good Content
Outline
Basics
PowerShell
Query Language
Instance Query
Register Events
Eventing
Intrinsic Events
extrinsic Events
Consumers
Attack History
Attack Surface
Reconnaissance
Code Execution
Persistence
WMI
WMI Providers
Investigating the Attacks
What to Expect
Reverse Engineering
Index BTR
AMI Warning
Detection
