Voted Best of Black Hat Asia 2018 Briefings
By Daniel Bohannon

In this presentation, I will dive deep into cmd[.]exe's multi-faceted obfuscation opportunities beginning with carets, quotes and stdin argument hiding. Next I will extrapolate more complex techniques including FIN7's string removal/replacement concept and two never-before-seen obfuscation and full encoding techniques â€" all performed entirely in memory by cmd[.]exe. Finally, I will outline three approaches for obfuscating binary names from static and dynamic analysis while highlighting lesser-known cmd[.]exe replacement binaries.

Full Abstract & Presentation Materials: https://www.blackhat.com/asia-18/brie...%f-in--style-do-s-level-cmd-obfuscation