Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation)

mej5L9PE1fs/default.jpg

Voted Best of Black Hat Asia 2018 Briefings
By Daniel Bohannon

In this presentation, I will dive deep into cmd[.]exe's multi-faceted obfuscation opportunities beginning with carets, quotes and stdin argument hiding. Next I will extrapolate more complex techniques including FIN7's string removal/replacement concept and two never-before-seen obfuscation and full encoding techniques Ă¢€" all performed entirely in memory by cmd[.]exe. Finally, I will outline three approaches for obfuscating binary names from static and dynamic analysis while highlighting lesser-known cmd[.]exe replacement binaries.

Full Abstract & Presentation Materials: https://www.blackhat.com/asia-18/brie...%f-in--style-do-s-level-cmd-obfuscation

mej5L9PE1fs/default.jpg
Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation) Invoke-DOSfuscation: Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation) Reviewed by Dump3R H3id3gg3R on June 27, 2018 Rating: 5