Hellow guys, Welcome to my website, and you are watching GHOSTS IN THE WMI. and this vIdeo is uploaded by Kaspersky at 2017-06-09T11:09:35-07:00. We are pramote this video only for entertainment and educational perpose only. So, I hop you like our website.
| Name | GHOSTS IN THE WMI |
| Video Uploader | Video From Kaspersky |
| Upload Date | This Video Uploaded At 09-06-2017 18:09:35 |
| Video Discription | Cybercriminals and APT actors know very well that when security researchers discover files, registry entries and other attacker trials, the operation is disrupted and a valuable toolkit is burned. Having a malware sample in hands gives researchers lots of important information on how an attack was conducted, what possibly was touched by the threat actor and sometimes even the C2 infrastructure and other data that can lead to attribution. However, when there is no sample available, investigation and forensics become an extremely tricky task. That's why fileless malware becomes more and more popular among high profile APT actors. One of the methods for achieving this goal is using the WMI mechanism built into each version of Windows since Windows 95. WMI is the powerful mechanism that gives administrators the ability to manage Windows hosts in the network both locally and remotely. If we talk about fileless malware, WMI is a nice choice because of three factors: the attacker instantly knows everything about the victim's machine, can execute code based on any event in the system and most importantly, WMI objects are stored in a special database, so there is no file to scan. Most likely, the first known example of usage of WMI in APT attack was Stuxnet. Since then these techniques were used quite rarely by attackers but each year we are discovering new methods based on WMI. In 2016 we had several cases of targeted attacks where WMI was used to perform fileless intrusions in high profile target networks. This presentation will go through several real world cases where WMI malware was used and take a look at attackers tricks arsenal and discuss how to detect and protect against such things. * Get exclusive access to more presentations given at #TheSAS2017: https://kas.pr/721r #KasperskyLab #cybersecurity #ITsecurity |
| Category | Science & Technology |
| Tags | #TheSAS2017 | KASPERSKY LAB | cyber security | itsecurity | conference |
