DEF CON 34 - Main - A Provider for the MOFia Distributed Post Ex Capabilities - Steven Flores
MentionsMicrosoftMicrosoft Windows
Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.
From time to time I take another pass at WMI to see if there's anything left in it that hasn't been picked over. For most of the last decade, offensive WMI has meant Win32_Process Create and event subscription persistence. Defenders built their detections around those two primitives, EDR vendors optimized for them, and the rest of WMI mostly got ignored. The provider architecture is one of the parts that got ignored. This talk is about turning it into a distributed post-exploitation framework.
Description from DEF CON.
Explained
The technology and terms in this story. Learn more
