The Invisibility Cloak: Obfuscate C# Tools to Evade Signature Based Detection | Brett Hawkins

Attend Wild West Hackin' Fest (WWHF) in Deadwood, In-Person and Virtual!
https://wildwesthackinfest.com/deadwood/

Attackers and offensive security professionals have been migrating from PowerShell to C# for post-exploitation toolkits, due to advances in security product configurations and features. An example of one of these improvements has been AMSI for .NET, which allows the scanning of .NET assemblies in memory. Currently, the majority of detections for these C# tools rely on static signatures, rather than the behaviors of the tools themselves. This talk …

detection signature tools