Hunting Windows U-boats with Cyber Depth Charges

SANS DFIR Summit 2022

Speaker: Michael Haag

Threat Hunting

As defenders, a lot of our time is focused on the most common ATT&CK techniques seen daily and weekly. Underneath common privilege escalation and defense evasion lies a deeper dark art - Windows rootkits. Rootkits are hard to identify as they can reside in the user or kernel level, or lower. The most advanced adversaries will persist and hijack systems using rootkits. As a defender, how do we hunt, where do …

cyber hunting windows