1. InfoconDB
  2. DEF CON
  3. DEF CON 30 (2022)
  4. The Purple Malware Development Approach

The Purple Malware Development Approach

Presented at DEF CON 30 (2022), Aug. 11, 2022, 9 a.m. (240 minutes).

This workshop merges offensive and defensive lab exercises to provide attendees hands-on experience on custom malware development as well as live malware analysis and response. The workshop has a total of 5 hands-on exercises and each contains a Red and a Blue section. In the Red section attendees write custom payloads using C# and C++ with different techniques to obtain a reverse shell on a Windows victim endpoint. In the Blue section attendees investigate the infection by reviewing events and logs using open source static and dynamic malware analysis tools like CFFExplorer, Pe-Studio, dnSpy, Process Explorer, Process Monitor, Sysmon, Frida, Velociraptor, etc.. Materials: Laptop with virtualization software. A Windows virtual machine A Kali Linux Virtual Machine. Prereq: Beginner to intermediate programming/scripting skills. Prior experience with C# helps but not required. Beginner static and dynamic malware analysis skills.

Presenters:

  • Olaf Hartong - Defensive Specialist
    Olaf Hartong is a Defensive Specialist and security researcher at FalconForce. He specializes in understanding the attacker tradecraft and thereby improving detection. He has a varied background in blue and purple team operations, network engineering, and security transformation projects. Olaf has presented at many industry conferences including WWHF, Black Hat, DEF CON, DerbyCon, Splunk .conf, FIRST, MITRE ATT&CKcon, and various other conferences. Olaf is the author of various tools including ThreatHunting for Splunk, ATTACKdatamap and Sysmon-modular.
  • Mauricio Velazco - Principal Threat Research Engineer
    Mauricio Velazco (@mvelazco) is a Principal Threat Research Engineer at Splunk. Prior to Splunk, he led the Threat Management team at a Fortune 500 organization. Mauricio has presented and hosted workshops at conferences like Defcon, BlackHat, Derbycon, BSides and SANS. His main areas of focus include detection engineering, threat hunting and adversary simulation.

Similar Presentations: