Modern Malware Evasion Techniques: Red and Blue Team Perspectives

Silvio La Porta & Antonio Villani

Silvio La Porta & Antonio Villani

RETooling

Abstract

This course offers an in-depth look at the techniques used in contemporary malware to evade detection by security products such as antivirus software, IPS, IDS, and EDR. We will explore how attackers design and operate their implants to ensure quick redeployment following detection or public disclosure by researchers or security vendors.

The training includes real-world scenarios that effectively hinder reverse engineering efforts, making the job of first responders more challenging. These techniques will be demonstrated in two ways: by reversing real malware samples and by re-implementing an improved version of the malware code. The training is designed from an attacker’s perspective, providing red teams with strategies to make their implants stealthier, while also teaching defenders how to counteract these anti-reversing and OPSEC techniques.

Trainer Info

Silvio La Porta & Antonio Villani

Silvio La Porta & Antonio Villani

Dr. Silvio La Porta is CEO and Co-Founder at RETooling defining and developing Threat Actor emulation platform enabling red team to recreate a realist attack scenario. Previously he was a Senior Cyber Security Architect designing security products and researching advanced detection technology for complex malware/APT. Silvio previously was a lead research scientist with EMC Research Europe based in the Centre of Excellence in Cork, Ireland. His primary research focus areas were real-time network monitoring and data analysis in smart grids to detect malware activity in SCADA systems and corporate networks. He was also leading Security Service Level Agreement (Sec-SLA) and end user security/privacy protected data store projects for hybrid Cloud environment. He is a frequent speaker in professional and industry conferences. Before joining EMC, Silvio worked as a Malware Reverse Engineer in Symantec’s Security Response team in Dublin, Ireland. Silvio holds a PhD in Computer Network Security from the University of Pisa, Italy.

Dr. Antonio Villani is the Co-Founder of RETooling. He is working full-time on the development of red-team and adversary emulation capabilities for his company. Previously he spent most of his time in the blueteam, reversing high level implants for top tier customers and providing detailed information to support cyber-defense and cyber threat intelligence teams. Now he analyzes complex implants to gain a deep understanding of the TTPs used by threat actors and to provide a high-quality reimplementation of them. As a researcher he published in top tier conferences and journals, and he participated in European research projects in the field of cyber resilience and data security. During his PhD he worked in the field of malware research and digital forensics.

Organizer

Organizer Logo

Partner Company

Partner Company Logo

Sponsors

POC Conference is made possible thanks to the support of our sponsors. Their continued partnership has played a vital role in sustaining and growing POC over the years. We sincerely thank them for their contribution.


Diamond

Party Sponsor

Gold

Silver

Supporting Friends