Fileless malware beyond a cursory glance

[Pages:24]Fileless malware

beyond a cursory glance

Alin PUNCIOIU Lucian SARARU

Classification: //SecureWorks/Confidential - Limited External Distribution:

Agenda

Overview Trends Modus Operandi Case Study

2

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

Overview

Security Landscape

Threat Actors in 2017

Reactive Cyber Security Operations

3

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

Overview

Enterprise Security

4

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

Fileless malware

Google trends

5

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

Fileless malware

Investigation

Assess Damage

How to measure and contain the damage

Discover IoCs

Find signatures for intrusion detection systems

In-depth analysis

Determine sophistication level

Ensure you've located all infected machines and files

Identify vulnerabilities

Exactly what happened

6

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

Modus operandi

Scorecard

Capture events/activity

Binary extraction

Incident Response and

Security Analytics

Endpoint forensics

Malware analysis

7

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

Modus operandi

Aiming

Stealth

Privilege escalation

Information gathering

Persistence

8

? SecureWorks, Inc.

Classification: //SecureWorks/Confidential - Limited External Distribution:

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download