WEBVTT

00:00:01.440 --> 00:00:02.350
[Autogenerated] awesome hope.

00:00:02.350 --> 00:00:05.650
Enjoy the demos, and I hope you got excited about evading detection systems.

00:00:06.240 --> 00:00:07.170
But before we go,

00:00:07.180 --> 00:00:10.750
I want to give some tips on how to be successful in your red team engagement.

00:00:11.740 --> 00:00:12.250
First.

00:00:12.290 --> 00:00:15.780
If you really want to make sure you not be detected and if you have enough time,

00:00:15.940 --> 00:00:17.750
right your own exploitation tools.

00:00:18.340 --> 00:00:20.840
Most of the end of our solutions a signature based.

00:00:21.070 --> 00:00:24.650
So if you use your own script, you have more chances of success.

00:00:25.440 --> 00:00:27.700
But I know it is really hard to write your own tools

00:00:27.700 --> 00:00:28.900
when you have tight deadlines.

00:00:29.440 --> 00:00:31.330
And that's why you have been vocal physician, too.

00:00:31.460 --> 00:00:33.000
And that's why you're watching this course.

00:00:33.640 --> 00:00:37.180
So if you're using obfuscation two, or even if you're right in your own quote,

00:00:37.320 --> 00:00:39.510
it is really important to understand how the detection

00:00:39.510 --> 00:00:41.350
magnus in your target government.

00:00:41.940 --> 00:00:44.060
And this means not only the interval solution,

00:00:44.160 --> 00:00:47.180
but also if the client has a host I PS and Natural

00:00:47.180 --> 00:00:49.250
detection two or even a seam solution.

00:00:49.940 --> 00:00:51.250
If you gather this information,

00:00:51.390 --> 00:00:55.150
it can then replicate out of detection mechanism of declines in your own lab,

00:00:55.690 --> 00:00:58.950
and in this way it becomes really used to test your obfuscated script.

00:00:59.940 --> 00:01:02.710
Also, when testing obfuscated script in your own lab,

00:01:02.880 --> 00:01:06.190
take a look on the logs rented by the windows and by the detection tools.

00:01:06.670 --> 00:01:08.770
Make sure the logs are not showing suspicious thing,

00:01:08.910 --> 00:01:10.650
because if the client has a seam solution,

00:01:10.720 --> 00:01:11.680
you trigger alerts.

00:01:12.840 --> 00:01:13.230
Also,

00:01:13.230 --> 00:01:16.010
another interesting tip here is to use the minimum required

00:01:16.010 --> 00:01:18.910
obfuscation for this crew to work and bypass detection.

00:01:19.570 --> 00:01:20.690
As you saw in the demos,

00:01:20.770 --> 00:01:23.450
it is really easy to apply multiple sophistication techniques,

00:01:23.840 --> 00:01:27.220
but from my experience, when I skip it has too many obfuscation bikinis.

00:01:27.460 --> 00:01:30.110
The inter virus may alert that's something so species happening.

00:01:30.840 --> 00:01:33.110
For example, if you convert the court to binary,

00:01:33.290 --> 00:01:36.310
then include the payload and then do some actual recording,

00:01:36.540 --> 00:01:38.490
the antivirals may say that is a species.

00:01:38.560 --> 00:01:40.450
He's a normal, softer would never do that.

00:01:41.140 --> 00:01:43.570
So on use enough obfuscation to be in there.

00:01:43.570 --> 00:01:44.110
The raider.

00:01:46.180 --> 00:01:48.600
If you want to learn more about the invoke office cation,

00:01:48.600 --> 00:01:51.130
too, you should check its official documentation on.

00:01:52.190 --> 00:01:55.950
In there, you find several examples and instructions on how to obfuscate cold.

00:01:56.440 --> 00:01:57.760
You can take this link mentally,

00:01:57.960 --> 00:02:01.680
or you can go to the exercise files for this course open the pdf

00:02:01.680 --> 00:02:03.750
for this light and click on the link there.

00:02:04.640 --> 00:02:04.930
Also,

00:02:04.930 --> 00:02:08.240
if you got interested in defense evasion and you want to learn the details on

00:02:08.240 --> 00:02:12.330
how these two works the altar of this to give a very interesting talk in the

00:02:12.330 --> 00:02:17.930
activity conference in 2016 His talk Daniel explains every single detail of the

00:02:17.930 --> 00:02:20.350
two and how each obfuscation technique works.

00:02:21.540 --> 00:02:23.010
Now we heard the defense side.

00:02:23.120 --> 00:02:25.850
You may be wondering how to detect when people using such tooth

00:02:26.440 --> 00:02:29.600
the same person that developed invoke obfuscation to developed

00:02:29.600 --> 00:02:33.120
another two called Revoke Obfuscation, which is able to detective,

00:02:33.120 --> 00:02:36.000
was scary cold and even deliver skate someone of code.

00:02:37.240 --> 00:02:39.900
Also, if you're wondering how to protect yourself in your company,

00:02:40.020 --> 00:02:43.810
a good start is to use an entity Mauer's technology that attacked money.

00:02:43.810 --> 00:02:46.550
Just quote based on behavior instead of signatures.

00:02:47.240 --> 00:02:50.650
And if you want to get really technical, it's a really good black hat.

00:02:50.660 --> 00:02:52.510
Talk about obfuscation detection,

00:02:53.310 --> 00:02:56.080
and there you see some really smart people talking about using

00:02:56.080 --> 00:02:59.650
mathematical models to detect malicious code and obfuscated code.

00:03:01.940 --> 00:03:02.710
So that's it.

00:03:02.880 --> 00:03:03.850
That's the end of the course.

00:03:04.290 --> 00:03:07.050
I hope that now you start obfuscating your code more often.

00:03:07.540 --> 00:03:08.220
In my opinion,

00:03:08.420 --> 00:03:10.840
this kind of technique is what differentiates our script

00:03:10.850 --> 00:03:12.850
kid from a real red team specialist.

00:03:13.540 --> 00:03:16.030
So I hope you enjoy this course, and I see you soon.