YoVDO

Skynet Will Use PsExec When SysInternals Go Bad

Offered By: YouTube

Tags

Conference Talks Courses Cybersecurity Courses Digital Forensics Courses System Administration Courses Anti-Forensics Courses

Course Description

Overview

Explore the potential misuse of Sysinternals tools for malicious purposes in this NolaCon 2017 conference talk. Delve into various internal reconnaissance techniques using PsInfo, PsLoggedOn, AdExplorer, ShareEnum, and TCPView. Learn about execution methods with PsExec and BgInfo, as well as persistence mechanisms utilizing PsPasswd and MoveFile. Discover anti-forensics techniques and methods for detecting Sysinternals usage through registry analysis, ShimCache examination, and Sdelete identification. Gain valuable insights into how attackers might leverage these powerful system utilities and how to defend against such tactics.

Syllabus

Intro
whoarewe
Our Prediction...
Why Use Sysinternals?
PsTools Disclaimer
Internal Recon PsInfo
Internal Recon PsLoggedOn
Internal Recon Logon Sessions
Internal Recon AdExplorer
Internal Recon ShareEnum
Internal Recon TCPView
Execution PsExec
Execution BgInfo
Persistence PsPasswd
Persistence MoveFile
Anti-Forensics MoveFile
Detecting Sysinternals Registry
Detecting Sysinternals ShimCache
Detecting Sysinternals Sdelete


Related Courses

Computer Security
Stanford University via Coursera
Cryptography II
Stanford University via Coursera
Malicious Software and its Underground Economy: Two Sides to Every Story
University of London International Programmes via Coursera
Building an Information Risk Management Toolkit
University of Washington via Coursera
Introduction to Cybersecurity
National Cybersecurity Institute at Excelsior College via Canvas Network