Subverting Sysmon: Application of a Formalized Security Product Evasion Methodology

While security products are a great supplement to the defensive posture of an enterprise, to well-funded nation-state actors, they are an impediment to achieving their objectives. As pentesters argue the efficacy of a product because it doesn't detect their specific offensive technique, mature actors recognize a need to holistically subvert the product at every step during the course their operation.

By Lee Christensen + Matt Graeber

Full abstract and materials:

Black Hat Briefings 2018,Black Hat USA 18,BlackHat,Black Hat,BlackHatUSA,Black Hat 2018 Briefings,Black Hat USA 2018,Black Hat Briefings,Black Hat USA,