SHAREM: Advanced Windows Shellcode Analysis Framework with Ghidra Plugin

Discover the power of SHAREM, an advanced Windows shellcode analysis framework integrated with the Ghidra plugin. Our experts will showcase how this tool enhances your ability to analyze and combat sophisticated Windows-based attacks.

Max Kersten

Trellix, Information Security Specialist

Bramwell Brizendine

Co-Presenter

Jake Hince

Co-Presenter

For more information

Unveiling the Shadows: Understanding Information Stealers and the Genesis Market Takedown for Enhanced Cyber Defenses

In this session, we delve into the world of information stealers, examining their methods, motivations, and the impact of their activities on victims. We explore the Genesis market takedown as a case study, shedding light on the inner workings of a major underground cybercrime marketplace that facilitated the sale of stolen credentials.

By the end of this session, participants will gain a comprehensive understanding of information stealers, the Genesis market takedown, and practical steps to enhance their organization's defenses against these sophisticated attack vectors.

Taylor Mullins

Consulting Solutions Engineer

For more information

DotNet Malware Analysis Masterclass workshop

DotNet based malware originally started out as a novelty, but has shown it is here to stay. With DotNet malware being used by APT actors and script kiddies, and anything in-between, it is safe to say that one will encounter it sooner rather than later. This four-hour workshop primarily focuses on the analyst mindset and fundamental knowledge, including topics such as loaders, unpacking, obfuscation, DotNet internals, and (un)managed hooks.

Max ‘Libra’ Kersten

Trellix, Malware Analyst

For more information

Game-Changing Advances in Windows Shellcode Analysis

Shellcode is omnipresent, seen or unseen. Yet tooling to analyze shellcode is lacking. We present the cutting-edge SHAREM framework to analyze enigmatic shellcode.

SHAREM can emulate shellcode, identifying 20,000 WinAPI functions and 99% of Windows syscalls. In some shellcode, some APIs may never be reached, due to the wrong environment, but SHAREM has a new solution: Complete code coverage preserves the CPU register context and memory at each change in control flow. Once the shellcode ends, it restarts, restoring memory and context, ensuring all functionality is reached and identifying all APIs.

Max ‘Libra’ Kersten

Trellix, Malware Analyst

Dr. Bramwell Brizendine

Assistant Professor at University of Alabama in Huntsville

Jake Hince

Cybersecurity Engineer

For more information

Power Corrupts: Corrupt It Back! Hacking Power Management in Data Centers

 

Our current administration lists "Defend Critical Infrastructure" as the DEF CON Forums item in the 2023 National Cybersecurity Strategy. At the intersection of governmental and corporate concerns is data center security, a trend that is bound to continue as more and more operations move to the cloud. This talk details our findings in the domain of power management, the first category in a broader effort to investigate the security of critical data center components.

Sam Quinn

Trellix, Sr. Security Researcher

Jesse Chick

Trellix, Security Researcher

For more information