From Dead Data to Digestion - Extracting Windows Fibers for Your Digital Forensics Diet

Embark on a journey through the intricacies of Windows Fibers in this 27-minute Black Hat conference talk. Discover how to reverse-engineer the underlying API, delve into the undocumented internals of Fibers, and leverage this knowledge to create granular detection telemetry from process memory. Learn about a novel tool called Weetabix, which automates the entire process, benefiting threat hunting teams and EDR developers. Presented by Daniel Jary, this talk offers valuable insights for digital forensics professionals seeking to enhance their investigative capabilities and expand their understanding of Windows internals.