Windows Defender - Demystifying and Bypassing ASR by Understanding the AV's Signatures

Este curso analiza la implementación de las reglas Attack Surface Reduction de Windows Defender y el formato de sus firmas. Muestra cómo instrumentar sus componentes, estudiar scripts y bases de datos de firmas, comparar actualizaciones y demostrar técnicas de evasión.

Syllabus

Intro
ASR: Attack Surface Reduction
Journey
Windows Defender 101
Exploring WD internals
WD: instrumentation
Test your skills!
Hunting for ASR rule implementation
Windows Defender signatures
Reading LUA scripts
ASR: Implementation?
ASR implementation. 2 way
ASR Test Tool: implementation
ASR: working test
ASR: exclusion
ASR: additional bypass
ASR: oddities
Signature format
Signatures modules
Specifics Threat
Signature: LUA
Signature: DBVAR
Signatures: update
Update rhythm
Update: oddities
Update: diffing - Friendly Files
Update diffing: C&C
Update diffing: unnecessary changes