Indicators of Compromise - From Malware Analysis to Eradication

Learn to identify and eradicate malware in corporate networks using freely available tools in this 50-minute workshop. Explore techniques from locating unknown malware to analyzing samples and identifying indicators of compromise. Dive into advanced topics like Windows internals, debug object handling, thread hiding, process exploitation, anti-dumping techniques, and virtual machine detection. Gain practical skills in malware analysis, reverse engineering, and enterprise-wide threat mitigation through hands-on exercises and expert guidance.

Intro
About me
Malware Research Lab, 2012
How INT3 breakpoints work
Memory Breakpoints
Hardware breakpoints
Timing
Windows Internals
Debug Object Handle
Thread Hiding
Open Process
Parent Process
UnhandledExceptionFilter
Process Exploitation
Nanomites
Stolen Bytes (Stolen Code)
Virtual Machines (think JVM, not Box)
Guard Pages
Removing the PE Header
Anti-dumping
Exploiting IA-32 Instructions
Interrupt 2D
Stack Segment
Instruction Prefixes
Exploiting LA-32 Instructions
VM Detection
Debugger specific techniques
Other Techniques
Announcement