Burning Bridges - Stopping Lateral Movement via the RPC Firewall

Автор: Black Hat

Загружено: 2022-01-31

Просмотров: 2366

Описание: In Windows based environments, RPC is the main underlying protocol required for remote administration and for Active Directory services. As such, it is often used by IT admins, but also by ransomware and advanced attackers to spread by creating remote services, scheduled tasks, DCOM objects, etc. It is also a major component in the persistency phase of attacks such as active directory DCSync, and even DC vulnerabilities such as Zerologon. The issue for defenders is that defending against remote RPC attacks is not trivial...

By: Sagie Dulce

Full Abstract & Presentation Materials: https://www.blackhat.com/eu-21/briefi...

Не удается загрузить Youtube-плеер. Проверьте блокировку Youtube в вашей сети.
Повторяем попытку...

Burning Bridges - Stopping Lateral Movement via the RPC Firewall

Доступные форматы для скачивания:

Скачать видео

Информация по загрузке:

Скачать аудио

Похожие видео

The Bad Guys Win – Analysis of 10,000 Magecart Vulnerabilities

The Bad Guys Win – Analysis of 10,000 Magecart Vulnerabilities

Lifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats

Lifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats

RPC Enumeration | Active Directory Penetration Testing

RPC Enumeration | Active Directory Penetration Testing

Сисадмины больше не нужны? Gemini настраивает Linux сервер и устанавливает cтек N8N. ЭТО ЗАКОННО?

Сисадмины больше не нужны? Gemini настраивает Linux сервер и устанавливает cтек N8N. ЭТО ЗАКОННО?

SyScan'14 Singapore: All About The Rpc, Lrpc, Alpc, And Lpc In Your Pc By Alex Ionescu

SyScan'14 Singapore: All About The Rpc, Lrpc, Alpc, And Lpc In Your Pc By Alex Ionescu

Как аналитики SOC на самом деле исследуют сетевой трафик (пошаговый обзор Wireshark)

Как аналитики SOC на самом деле исследуют сетевой трафик (пошаговый обзор Wireshark)

ATT&CK Deep Dive: Lateral Movement Pt. 1

ATT&CK Deep Dive: Lateral Movement Pt. 1

Операции C2 с Cobalt Strike

Операции C2 с Cobalt Strike

Keynote: Clocking On

Keynote: Clocking On

BlueHat IL 2023 — Джеймс Форшоу — Аутентификация Windows

BlueHat IL 2023 — Джеймс Форшоу — Аутентификация Windows

ChaosDB: How We Hacked Databases of Thousands of Azure Customers (rev)

ChaosDB: How We Hacked Databases of Thousands of Azure Customers (rev)

Понимание Active Directory и групповой политики

Понимание Active Directory и групповой политики

Attack Detection Fundamentals: Workshop #3 - Discovery and Lateral Movement

Attack Detection Fundamentals: Workshop #3 - Discovery and Lateral Movement

Проблема нержавеющей стали

Проблема нержавеющей стали

Searching for RPC Functions to Coerce Authentications in Microsoft Protocols

Searching for RPC Functions to Coerce Authentications in Microsoft Protocols

#55 Side Channel Analysis | Information Security 5 Secure Systems Engineering

#55 Side Channel Analysis | Information Security 5 Secure Systems Engineering

UEFI Malware - The Low Level Threat To Millions of PCs

UEFI Malware - The Low Level Threat To Millions of PCs

Clustered Points of Failure - Attacking Windows Server Failover Clusters

Clustered Points of Failure - Attacking Windows Server Failover Clusters

КАК УСТРОЕН TCP/IP?

КАК УСТРОЕН TCP/IP?

Deep House Mix 2024 | Deep House, Vocal House, Nu Disco, Chillout Mix by Diamond #3

Deep House Mix 2024 | Deep House, Vocal House, Nu Disco, Chillout Mix by Diamond #3