MalOpSec → EDR: The Great Escape

MalOpSec → EDR: The Great Escape will present an in-depth description of the techniques implemented in modern malware to evade mainly EDR and their internal AV systems. The course will also cover real-world scenarios that impair (effectively slow-down or dissuade) reverse engineering efforts and make the job of first responders tougher. The techniques will be demonstrated in two ways: first, by reversing real malware samples, and then by re-implementing an improved version of the malware code. The training is designed from an attacker's point of view, teaching red-teams how to make their implants stealthier, but it will also teach defenders how to deal with the anti-reversing and the OPSEC techniques demonstrated in class. We focus on Windows malware and on the analysis, tweaking and re-purposing of real malware samples. Participants will be provided with plenty of custom code to facilitate the understanding of complex malware techniques. As part of the course, theory sessions will be followed by exercises where participants will reverse and re-implement specific parts of real malware in order to fully understand the hidden corners of all the techniques involved. About 50% of the course will be dedicated to hands-on labs that will show how to translate the theory principles into practice. The labs are designed to provide flexibility in terms of complexity and include bonus tracks to ensure that you always feel engaged and have something interesting to explore and learn.

• Programming experience (C, C++, Python, .NET, and PowerShell)
• Be familiar with assembly language and Debuggers (IDA pro, WinDBG)
• Debugging Tools for Windows (Ida Pro, WinDBG) (Decompiler recommended)
• Guest OS Windows 10 64-bit Version 20H2
• System Administrator access required on both host and guest OSs
• 60 GB free Hard disk space

Dr. Silvio La Porta is CEO and co-faunder at Retooling defining and developing threat actor emulation platform enabling red team to recreate a realist attack scenario. Previously he was a senior cyber security architect designing security products and researching advanced detection technology for complex malware/apt. Silvio previously was a lead research scientist with EMC research europe based in the centre of excellence in Cork, Ireland. His primary research focus areas were real-time network monitoring and data analysis in smart grids to detect malware activity in scada systems and corporate networks. He was also leading security service level agreement (sec-sla) and end user security/privacy protected data store projects for hybrid cloud environment. He is a frequent speaker in professional and industry conferences. Before joining EMC, silvio worked as a malware reverse engineer in symantec’s security response team in Dublin, Ireland. Silvio holds a PhD in computer network security from the University of Pisa, Italy.

Dr. Antonio villani is co-founder at retooling and spent the past years analyzing high level implants for top tier customers, providing detailed implementation information to support cyber-defense and cyber threat intelligence teams. Now, he uses his experience in the reverse-engineering of multi-stage implants re-implementing it to improve retooling attack emulation product. As a researcher he published in top tier conferences and journals and he participated to european research projects in the field of cyber resilience and data security. During its phd he worked also in the field of malware research and digital forensic.