Indicators of Compromise - From Malware Analysis to Eradication
44CON Information Security Conference via YouTube
Overview
Syllabus
Intro
About me
Malware Research Lab, 2012
How INT3 breakpoints work
Memory Breakpoints
Hardware breakpoints
Timing
Windows Internals
Debug Object Handle
Thread Hiding
Open Process
Parent Process
UnhandledExceptionFilter
Process Exploitation
Nanomites
Stolen Bytes (Stolen Code)
Virtual Machines (think JVM, not Box)
Guard Pages
Removing the PE Header
Anti-dumping
Exploiting IA-32 Instructions
Interrupt 2D
Stack Segment
Instruction Prefixes
Exploiting LA-32 Instructions
VM Detection
Debugger specific techniques
Other Techniques
Announcement
Taught by
44CON Information Security Conference