Catch Me If You Can. LOLBins and the Adversaries Who Abuse Them
summary
Maps specific Windows binaries and admin tools to real campaigns, with measurable use rates: PowerShell 40%, WMIC 21%, scheduled tasks ~20% and MSHTA 8%. Provides concrete examples — Lazarus using PowerShell to retrieve payloads and Cobalt Strike, Sodinokibi using PowerShell plus Rundll32 to dump credentials, LockBit using WMIC to remove shadow copies, and Rclone exfiltration to Dropbox. Shows defenders how attacks dump LSASS (often via ProcDump dumping LSASS or Mimikatz) and lists actionable detections and Event IDs to monitor.
AI-written summary · about
chapters (13)
- 0:00RSAConference 2023
- 2:35Tracked Malware, Tools and Binaries
- 4:15Methodology Maliciousness & Madness
- 5:57Mapped Back To MITRE ATT&CK
- 9:01PowerShell-How Did They Use It
- 11:21WMIC - How Did They Use It
- 13:03Scheduled Task-Who's Used It
- 14:04Scheduled Task - How Did They Use It
- 16:44MSHTA - How Did They Use It
- 20:08Mimikatz - How Did They Use It
- 27:33ProcDump - Who's Used It
- 31:11LaZagne - How We've Seen It Used
- 32:34Defense/Countermeasures Apply What You Have Learned Today
related talks
42mStart Covering Your Bases And Stop Chasing APT Headlines
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
52mStart covering your bases & Stop chasing APT headlines
36mBeing A Better Defender By Channeling Your Worst Adversary:
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
47mThe Blurred Lines between Cybercrime and Statecraft
49mPowerShell for Security Incident Response
41m"Revenge of The Script Kiddies: Current Day Uses..."