Thursday 1 October 10:00 - 10:30, Green room
Paul Litvak (Intezer)
The development and publication of offensive security tools (OSTs) has become one of the more controversial talking points in the information security community. Some argue releasing such tools to the Internet is irresponsible as it allows adversaries to outsource the development of tools and techniques from the InfoSec communities. Others believe the publication of these tools serves as a cornerstone to the education of new researchers, allowing defenders to mitigate newly discovered techniques and probe their own defences. However, little research has been presented to support either argument.
This research was conducted in order to show the extent of the influence of offensive security tools on adversary operations, specifically the use of open-source OSTs. We gathered relevant leading open-source projects (such as MimiKatz, UACME, and many more) and compiled them with various configurations and flags in order to generate all possible binary code patterns. Using the code patterns we generated, we searched for similar code reuse patterns across a database of millions of malware samples and were able to create a map of open-source OST adoption by malware families.
In this talk, a comprehensive map of the relationship between various OST open-source projects and threat actors is presented, i.e. the use of code injection, privilege escalation, lateral movement technique implementation projects. We will also cover the steps undertaken to build the map and explain each one of them. Finally, we will explain how familiarity with these projects allows defenders to build YARA signatures based on code patterns and expose real, undetected malware campaigns that were discovered based on this technique, together with the relevant YARA signatures.
 |
Paul Litvak Paul is a security researcher and reverse engineer at Intezer. Paul previously served in the Israeli Defense Force (IDF) intelligence corps as a developer and later as a technical researcher specializing in OSINT automation. In his free time, Paul tinkers with various technologies and solves CTF challenges. |
