Close Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
summary
Demonstrates a full-chain Windows kernel post‑exploit: a discovered AFD n‑day turned into a working exploit in ~24 hours to load a signed vulnerable driver on Windows 11 22H2, then uses DKOM to alter ETW registration entries, flip undocumented feature flags via the CmF system manager, implement a high‑speed keylogger by mapping the global GFAsyncKeyState physical page into userland, and drop CrowdStrike telemetry using Windivert‑style network filtering; VBS/HVCI limit driver loads but page remapping and thread‑context tricks still enable many attacks.
AI-written summary · about
chapters (10)
- 0:00Rootkits and post-exploitation
- 2:34Vulnerable drivers for rootkits
- 7:52Kernel space operation
- 10:05ETW and callbacks for stealth
- 16:09Keylogging without API calls
- 21:05Feature flag manipulation
- 25:48Network filtering and EDR evasion
- 29:27Bypassing virtualization security
- 35:07Defensive recommendations
- 36:21Q&A
related talks
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
46mD2T2 - Over The Edge: Pwning The Windows Kernel
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
01h 06mHow hacking works
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
52mA New CVE-2015-0057 Exploit Technology
33mExploring a New Class of Kernel Exploit Primitive
39mProxying to Kernel:Streaming vulnerabilities from Windows Kernel