For a long time, many organizations could make a safe enough bet relying on antivirus and firewall to protect against threats. However, today’s sophisticated attackers and malware are adept at evading those defenses. In this presentation from her on-demand webinar, enterprise security MVP, Paula Januszkiewicz, puts on her hacker cap and walks you through: - Techniques of bypassing the antivirus mechanisms - Tactics used today by malware that allows it to run - Prevention methods to avoid being attacked by the newest cybercriminals’ innovations - Why least privilege security is essential for defending against hackers BeyondTrust’s PowerBroker for Windows Product Manager, Jason Silva, caps off this webinar by showing attendees how eliminating admin rights and elevating rights to secure applications only, can help augment traditional antivirus solutions and keep you protected against more sophisticated threats. You can find the full webinar recording here: https://www.beyondtrust.com/resources/webinar/hacker-techniques-bypassing-existing-antivirus-solutions-build-defense-least-privilege/

1. Hacker techniques for bypassing
existing antivirus solutions & how to
build a defense with least privilege
Paula Januszkiewicz
CQURE: CEO, Penetration Tester;
Security Expert
CQURE Academy: Trainer
MVP: Enterprise Security, MCT
www.cqureacademy.com
@paulacqure
@CQUREAcademy
CONSULTING

4. Agenda

8. Techniques for malware discovery
Signature-based
Behavior-based
Attempts to open, view, delete, and/or modify files
Attempts to format disk drives and other unrecoverable disk
operations
Modifications to the logic of executable files, scripts of macros
Modification of critical system settings, such as start-up settings
Scripting of e-mail and instant messaging clients to send
executable content
Initiation of network communications

9. 1- Evasion Techniques Used by Malware
Wrapping
ttaches the malicious payload (the installer or the
malware itself) to a legitimate file.

11. 2- Evasion Techniques Used by Malware

12. Reflective PE Loader
Custom code
User Mode Loaders
Executable is extracted and decrypted in memory
Code is loaded and executed dynamically
In Powershell.exe – not every module is embedded – they
can be created and loaded during the execution
In Win32API: Custom code mimics LoadLibrary()
Interesting: During the compilation, that’s what helps us:
CompilerParameters.CompilerOptions =
"/platform:x64";

14. 3- Evasion Techniques Used by Malware

16. Agenda

19. Summary: Bypassing techniques and mitigations
1. The only cure is a _complete_
code execution prevention
2. Anti-Exploit solutions make a lot
of sense
3. Sysmon (absolutely!)
4. At the end it is a matter of
budget and price
5. Code execution prevention
solutions are often misconfigured

21. by Paula Januszkiewicz
Interested? Drop us quick email at: info@cqure.us
More info: https://cqureacademy.com/cyber-security-training

22. >> ONLINE <<
Cqureacademy.com/30days

24. PowerBroker for
Windows
Least Privilege and Application Control
for Windows Servers and Desktops

25. Summary: Why PowerBroker for Windows?
• Asset discovery, application control, risk compliance, Windows event log monitoring included
• Optional: Session monitoring, file integrity monitoring
Deep capability
• U.S. Patent (No. 8,850,549) for the methods and systems employed for controlling access to
resources and privileges per process
Mature, patented leader
• Tightly integrated with vulnerability management
• Deep reporting and analytics insights for compliance and operations
Centralized reporting,
analytics and
management
• Privilege and session management on Unix, Linux and Windows
• Privileged password and session management
• Integrate Linux, Unix, and Mac OS X with Microsoft AD
• Real-time auditing of AD, File System, Exchange & SQL
Part of a broad solution
family
Validatedbycustomersandanalystsalike

26. Your solution should:
• Elevate privileges to applications, not users, on an as-needed basis without
exposing passwords
• Enforce least-privilege access based on an application’s known vulnerabilities
• Track and control applications with known vulnerabilities or malware to further
protect endpoints
• Monitor event logs and file integrity for unauthorized changes to key files and
directories
• Capture keystrokes and screens when rules are triggered with searchable
playback

27. Product Demonstration

28. Poll + Q&A
Thank you for attending
today’s webinar.