Backdoor Investigation and Incident Response: From Zero to Profit
summary
An online gaming company suffers a breach where an SSL VPN exploit yielding credentials lets attackers access Active Directory, create administrative accounts, and pivot via SMB to application servers; a malicious IIS module (malicious ISAPI DLL transthetic.dll / static.dll) triggers errors and loads unauthorized code that edits the transactional database to grant wins. Investigation uses string/frequency and similarity analysis, a graph-based prioritization workflow, and custom YARA/network rules to find other backdoored servers and estimate multi-million daily losses.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:41Case study background
- 3:35Vulnerability analysis
- 6:17Attacker lateral movement
- 8:42Incident conclusion
- 9:39Detecting stealthy backdoors
- 12:56Incident summary and response
- 14:47Playbook proposal
- 17:17Detection methodology
- 20:11AI in malware detection
- 22:12Investigation workflow
- 27:01Response matrix dimensions
- 30:04Advanced backdoor analysis
- 33:24Server forensic techniques
- 36:06Network traffic analysis
- 39:07Conclusion and Q&A
related talks
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
53mForensic Investigations of Web Exploitations
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mReal World Stories of Incident Response and Threat Intelligence
37mThreat Hunting in Active Directory Environment
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
49mStories from the trenches - How a red team exercise gained full control of a client network