Beyond Living-Off-the-Land: Why XP Exploits Still Matter
summary
Claim: attackers bring and exploit older signed Windows binaries such as a Windows XP wdigest.dll plus an XP rundll32 to run shellcode that reuses code gadgets (no ASLR) and keep payloads fileless and victim-specific via DPAPI per-victim encryption. Observed in the InvisiMole campaign with four persistence strategies, registry-stored encrypted stages, and an exploit-triggering config for an outdated video player. Defenses tested: white-listing/WDAC or AppLocker by minimum patched version, EDR heuristics for unsigned or misversioned binaries, and Yara/Sigma rules.
AI-written summary · about
chapters (4)
related talks
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
44mAnatomy and Defense of LOTL Fileless Intrusions
51mThe Anatomy of an Exploit
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
48m"Sneaking Past Device Guard"
42mStart Covering Your Bases And Stop Chasing APT Headlines
51mSneaking Past Device Guard