Detection of Advanced Attacks with a CPU Level Sandbox Technology
summary
Describes a CPU-level sandbox technology that monitors processor activity during the exploit phase to detect advanced attacks. Contrasts this approach with traditional OS-level sandboxes and claims it can catch exploits that evade file- and OS-level inspection by observing CPU behavior at the moment of exploitation.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:25An Ever-Changing Threat Landscape
- 5:55Common Spear Phishing Objects
- 6:53Sandbox: Defend from the Unknown
- 7:33Sandbox Evasion Techniques
- 9:00The Attack Chain in Data Files Let's check under the hood...
- 11:01Identify Malware at the Exploit Phase
- 12:06OS and CPU Security Controls
- 14:33Building a ROP Gadgets Dictionary To gain privileges to run the malware
- 15:57Exploit Using a ROP Chain
- 16:33Leveraging the Haswell CPU
- 17:22Building a ROP Gadgets Dictionary - From the Processor Perspective.
- 19:13Advantages of CPU-Level Detection
related talks
44mSlime: Automated Anti-Sandboxing Disarmament System
49mConfessions of a Sandbox: How AI is Disrupting Automated Threat Analysis
30mSandBox Mode (SBM) - New Execution Mode Between Kernel and User Space
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
42mCPU Fuzzing: Automatic Discovery of...
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
25mCloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks
27mSecurity panel: Can your platform survive AI?