Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures

Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures

Black Hat via YouTube Direct link

Intro

1 of 28

1 of 28

Intro

Class Central Classrooms beta

YouTube playlists curated by Class Central.

Classroom Contents

Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures

Automatically move to the next video in the Classroom when playback concludes

  1. 1 Intro
  2. 2 ASR: Attack Surface Reduction
  3. 3 Journey
  4. 4 Windows Defender 101
  5. 5 Exploring WD internals
  6. 6 WD: instrumentation
  7. 7 Test your skills!
  8. 8 Hunting for ASR rule implementation
  9. 9 Windows Defender signatures
  10. 10 Reading LUA scripts
  11. 11 ASR: Implementation?
  12. 12 ASR implementation. 2 way
  13. 13 ASR Test Tool: implementation
  14. 14 ASR: working test
  15. 15 ASR: exclusion
  16. 16 ASR: additional bypass
  17. 17 ASR: oddities
  18. 18 Signature format
  19. 19 Signatures modules
  20. 20 Specifics Threat
  21. 21 Signature: LUA
  22. 22 Signature: DBVAR
  23. 23 Signatures: update
  24. 24 Update rhythm
  25. 25 Update: oddities
  26. 26 Update: diffing - Friendly Files
  27. 27 Update diffing: C&C
  28. 28 Update diffing: unnecessary changes

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.