A full description of the Workshop:

This workshop is all about sharing the experience with all, how we can make use of advanced evasion techniques in order to Bypass different Endpoint Detection and Response (EDR) systems. First we will start with the basics of Windows Internals (PEB, TEB, Winapi, etc) with process injection examples.

Next, participants will receive a primer on Endpoint Detection and Response systems and how they perform User-Mode hookings. Then we would start focusing on how Ntapis work and then delve down to syscall concepts. From here, we would start creating Implants based on syscalls and move down to advanced forms of malware development techniques, like thread stack spoofing and shellcode start address spoofing. We would also be showing how to detect those types of implants. This workshop would help individuals to up-skill their Malware development as well as defensive skills altogether.

Topics that will be Covered

1. Introduction
2. Windows Internals
3. Process Injection
4. EDR Bypass Techniques
5. System Call Introduction
6. Direct Static System Call (Offensive and defensive side)
7. Direct Dynamic Systemcall with API Hashing (Offensive and defensive side)
8. Indirect Dynamic SystemCall with API Hashing (Offensive and defensive side)
9. Call Stack Monitoring Evasion (Offensive and defensive side)
10. Newly Created Thread Start Address spoofing.