A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Subscribestar or Patreon

Search Irongeek.com:

Affiliates:
Irongeek Button
Social-engineer-training Button

Help Irongeek.com pay for bandwidth and research equipment:

paypalpixle


Windows Operating System Archaeology - (BSides Nashville 2017) (Hacking Illustrated Series InfoSec Tutorial Videos)

Windows Operating System Archaeology

Casey Smithand Matt Nelson

BSides Nashville 2017
http://bsidesnash.org

The modern Windows Operating System carries with it an incredible amount of legacy code. The Component Object Model (COM) has left a lasting impact on Windows. This technology is far from dead as it continues to be the foundation for many aspects of the Windows Operating System. You can find hundreds of COM Classes defined by CLSID (COM Class Identifiers). Do you know what they do? This talk seeks to expose tactics long forgotten by the modern defender. We seek to bring to light artifacts in the Windows OS that can be used for persistence. We will present novel tactics for persistence using only the registry and COM objects.

Casey Smith (@subTee) is a Researcher with the Veris Group Adaptive Threat Division. His interests include testing and understanding defensive systems. Matt Nelson (@enigma0x3) is a Red Teamer and Researcher with the Veris Group Adaptive Threat Division. Matt has a passion for offensive PowerShell, is an active developer on the PowerShell Empire project, and helps build offensive toolsets to facilitate red team engagements.

Back to BSides Nashville 2017 list

Printable version of this article

15 most recent posts on Irongeek.com:


If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2020, IronGeek
Louisville / Kentuckiana Information Security Enthusiast