Embark on a journey through the intricacies of Windows Fibers in this 27-minute Black Hat conference talk. Discover how to reverse-engineer the underlying API, delve into the undocumented internals of Fibers, and leverage this knowledge to create granular detection telemetry from process memory. Learn about a novel tool called Weetabix, which automates the entire process, benefiting threat hunting teams and EDR developers. Presented by Daniel Jary, this talk offers valuable insights for digital forensics professionals seeking to enhance their investigative capabilities and expand their understanding of Windows internals.
From Dead Data to Digestion - Extracting Windows Fibers for Your Digital Forensics Diet
Overview
Syllabus
From Dead Data to Digestion: Extracting Windows Fibers for Your Digital Forensics Diet
Taught by
Black Hat
Related Courses
Reviews
5.0 rating, based on 1 Class Central review
-
Very Informative! Learnt a lot. Useful tool release `weetabix` alongside the presentation allowed me to identify anomalous fiber usage in memory!
