Anatomy and Defense of LOTL Fileless Intrusions
summary
84% of incidents in 2025 involve living-off-the-land binaries and 47% of initial access is via click‑to‑fix lures, the talk demonstrates. Asteroth uses LNK → WMIC → NTFS alternate data streams (desktop.ini) → sortutil decode → regsvr32 and process‑hollowing; Storm249 uses click‑lures, curl and DLL side‑loading; Cookbook stores Base64 chunks across registry keys and Invoke‑Expression; HeadCrab scans internet‑exposed RADIUS with default creds, runs SLAVEOFF to load modules and crypto‑mine. Defenses: user training, Windows ASR, PowerShell constrained mode, advanced logging, EDR and blocking egress for trusted utilities.
AI-written summary · about
chapters (13)
- 0:00Introduction to LOTL intrusions
- 3:15Defining fileless and LOTL attacks
- 5:03Initial attack vectors explained
- 10:21Four real-world malware examples
- 11:03Asteroth malware breakdown
- 15:04Storm 249 and DLL side-loading
- 18:44Cookbook hiding in registry
- 19:50HeadCrab targeting servers
- 21:59Commonalities in LOTL malware
- 27:31Human resilience and training
- 30:00Technical defense strategies
- 36:25Key takeaways and conclusion
- 37:28Q&A session
related talks
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
52mRansomware 101: Get Smart Understanding Real Attacks
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
42mStart Covering Your Bases And Stop Chasing APT Headlines
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
52mStart covering your bases & Stop chasing APT headlines
26mTechnical Tracks