Cyber Defense Initiative^® 2012

Forensic Campus - "Detecting Persistence Mechanisms"

• Alissa Torres
• Monday, December 10th, 8:15pm - 9:15pm

Often times, artifacts of persistence created by an attacker in order for their malware to survive on a system are important leads to unravel the adversary's methodologies. These techniques, including registry keys, scheduled tasks and other methods, can be excellent indicators for the signature creation used in enterprise scanning. How do you find these valuable artifacts? What tools can you use to aid in their discovery? This presentation covers the common persistence techniques used in today's malware and the forensic techniques and tools that can be used to uncover them.