In-Memory Persistence: Terminate & Stay Resident Redux

Presented at DerbyCon 8.0 Evolution (2018), Oct. 5, 2018, 5 p.m. (50 minutes).

Maintaining persistence on a network is important. With the wider adoption of endpoint via EDR, the approach of persisting via on-disk artifacts is under increasing pressure. This talk outlines how in-memory persistence can be achieved cheaply and effectively, and how using automated & coordinated lateral movement can be combined with in-memory persistence to maintain a network toehold without disk artifacts.

Presenters:

• Scott Lundgren

Similar Presentations:

• THOTCON 0x9 (2018) / Reflective PE Unloading
• Objective by the Sea version 6.0 (2023) / Did Apple Solve Persistence? Demystifying Background Task Management
• CactusCon 12 (2024) / Clearing the Fog: Detection and Defense against Cloud Persistence Techniques