BHIS | Getting Started in Covert .NET Tradecraft for Post-Exploitation – Kyle Avery

0:00:00 - FEATURE PRESENTATION: Covert .NET Tradecraft
0:01:25 - Agenda
0:01:55 - Intro to .NET - What is it?
0:06:16 - Intro to .NET - Key Features
0:08:59 - Intro to .NET - Why do we care?
0:11:57 - Methods of Execution - .NET Assembly Execution
0:13:42 - Methods of Execution - Fork-n-Run OPSEC
0:24:40 - Methods of Execution - .NET Execution without Fork-n-Run
0:28:28 - DEMO: Third Eye
0:29:20 - .NET Log Sources - ASMI
0:32:48 - .NET Log Sources - ETW
0:36:37 - .NET Obfuscation
0:39:22 - .NET Obfuscation - ConfuserEX
0:40:58 - DEMO: Obfuscate Seatbelt
0:41:33 - .NET Obfuscation - Additional Obfuscation
0:46:44 - Operation Prechecks
0:48:13 - Operation Prechecks - DNSpy
0:49:15 - Operation Prechecks - ThreatCheck
0:49:53 - DEMO: Running ThreatCheck
0:50:47 - Operation Prechecks - SilkETW
0:51:47 - DEMO: SilkETW
0:52:36 - Operation Prechecks - Elastic Endpoint
0:53:44 - DEMO: Setting Up Elastic Endpoint
0:58:44 - Closing Thoughts
1:00:43 - QnA

Description: This Black Hills Information Security (BHIS) webcast will cover OPSEC safe fork-n-run execution with Cobalt Strike, .NET log sources available to network defenders and security vendors, and obfuscation of public C# tools to evade EDR products consistently.

Black Hills Infosec Socials

Black Hills Infosec Shirts & Hoodies

Black Hills Infosec Services

Backdoors & Breaches - Incident Response Card Game

Antisyphon Training

Educational Infosec Content

#bhis #infosec