WEBVTT

00:00:00.040 --> 00:00:03.280
Now that we have a good understanding of how Meterpreter works,

00:00:03.440 --> 00:00:05.390
if you want to get past defenses,

00:00:05.400 --> 00:00:10.010
we need to understand at a high level how defenses work and why they might be

00:00:10.010 --> 00:00:13.650
able to block or detect Meterpreter stages and payloads.

00:00:13.830 --> 00:00:18.100
We will focus here on antivirus and endpoint detection and response solutions,

00:00:18.110 --> 00:00:19.750
also known as EDR.

00:00:20.040 --> 00:00:24.750
We will cover the main components that make up most antivirus and EDR solutions,

00:00:24.940 --> 00:00:28.220
and we will look at the type of detections that we may encounter.

00:00:28.350 --> 00:00:31.070
I will demonstrate how many of the techniques used

00:00:31.070 --> 00:00:33.220
to detect our tradecraft work.

00:00:33.320 --> 00:00:36.030
We will cover emulation and API monitoring,

00:00:36.250 --> 00:00:39.330
kernel‑mode drivers, and event tracing for Windows,

00:00:39.340 --> 00:00:40.830
as well as AMSI.

00:00:40.840 --> 00:00:44.620
Understanding these technologies will help you understand many of the evasion

00:00:44.620 --> 00:00:47.280
techniques, which we will be looking into during the course.

00:00:47.280 --> 00:00:51.190
Endpoint security solutions, such as antivirus and EDR,

00:00:51.190 --> 00:00:53.980
are usually made up of multiple components.

00:00:54.140 --> 00:00:56.150
First, we have kernel‑mode drivers,

00:00:56.150 --> 00:00:59.650
which can be leveraged to install callback routines,

00:00:59.790 --> 00:01:03.160
which will be notified when certain events occur on the system.

00:01:03.240 --> 00:01:07.740
File system filter drivers and network drivers are also used extensively by

00:01:07.740 --> 00:01:11.980
antivirus and EDR to monitor file system and network activity.

00:01:12.240 --> 00:01:14.550
Next, we have user‑mode services.

00:01:14.820 --> 00:01:17.830
This is usually the component which communicates with cloud

00:01:17.830 --> 00:01:21.220
services and centralizes all the data collected on the

00:01:21.220 --> 00:01:23.460
endpoint so that it can be correlated.

00:01:23.640 --> 00:01:27.150
In some cases, we may encounter API monitoring constructs,

00:01:27.540 --> 00:01:30.720
which can be leveraged to gain insight into process behavior.

00:01:30.720 --> 00:01:34.150
You may also encounter event tracing for Windows,

00:01:34.160 --> 00:01:41.460
also known as ETW. ETW providers can be consumed by security solutions to

00:01:41.460 --> 00:01:45.010
collect additional telemetry about events occurring on the system.

00:01:45.280 --> 00:01:49.440
Next, we have emulators and sandboxes, which are also used by some

00:01:49.440 --> 00:01:53.610
solutions to analyze files and scripts dynamically to gain insight into

00:01:53.610 --> 00:01:58.480
their runtime behavior. And finally, we have AMSI providers, which can be

00:01:58.480 --> 00:02:01.060
registered to scan scripts at runtime.