From Zero to Success
summary
Claims a real bug in Cisco's EDR and shows a working bypass: an obfuscated PowerShell reverse shell hosted via a simple HTTP server, fetched with Invoke-WebRequest and executed with Invoke-Expression to download-and-execute-in-memory. Uses living‑off‑the‑land tooling and a netcat listener; outbound connection appears in the cloud dashboard but the EDR has no runtime visibility so the session succeeds and leaves no disk artifacts. Proof of concept completes in weeks.
AI-written summary · about
chapters (9)
- 0:00Conference introduction
- 1:09Cisco EDR research
- 2:40EDR systems overview
- 8:02EDR solution features
- 8:23EDR bypass techniques
- 13:51Reverse shells explained
- 16:23Fileless attack workflow
- 21:48Attack success takeaways
- 22:35Q&A on memory forensics
related talks
38mDirty Vanity: A New Approach to Code Injection & EDR Bypass
01h 06mHow hacking works
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
30mTales of Red Teaming
49mStories from the trenches - How a red team exercise gained full control of a client network
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
52mStart covering your bases & Stop chasing APT headlines
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home