Hiding in plain sight from blue teams | Henri Hambartsumyan | WWHF San Diego 2022

Attend Wild West Hackin' Fest (WWHF) in Deadwood, In-Person and Virtual!
https://wildwesthackinfest.com/deadwood/

Blue teams using detection logic to detect attacks always need to balance the false positives and false negatives. One very common way of dealing with false positives is to allow “known good” – i.e. allow lists. This presentation is about my research of real-world data to identify and classify such “known good” behaviours in “common software”. With this overview of “known good” software, you can start replicating the …

blue san san diego teams wwhf