"A rootkits writer’s guide to defense"
summary
A phishing incident shows attackers cloning SSO pages and bypassing push MFA; response kills sessions and locks accounts within 20 minutes but reveals 20+ spoof domains and aggressive session harvesting. Analysis finds many Linux rootkits reused from Phrack/old APT toolkits using LD_PRELOAD library detection evasion and file-hiding that returns ENOENT. Defenses implemented: mapping data sources to ATT&CK, using Atomic Red Team, alerting on writes to /usr/bin and package-managed paths, monitor raw socket creation and new cron/systemd jobs, plus a lightweight agent that flags ~99% of user-space rootkits.
AI-written summary · about
chapters (8)
- 0:00Start
- 12:08Challenges
- 22:57What's the magic code?
- 24:12Rootkits have bugs
- 33:53Network Security Monitoring
- 38:18Detection - installation
- 38:47Detection - execution
- 39:22Detection - persistence
related talks
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
52mStart covering your bases & Stop chasing APT headlines
42mStart Covering Your Bases And Stop Chasing APT Headlines
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
39mHow to think like a hacker
40mAndroid Rootkits: Analysis from Userland and Kernelland
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
59mCounter-Infiltration: Future-Proof Counter Attacks Against Exploit Kit Infrastructure