mattifestation / mattifestation

Conference Presentations

Date	Conference	Talk Title
11-Aug-22	Black Hat USA 2022	Living Off the Walled Garden: Abusing the Features of the Early Launch Antimalware Ecosystem
2-Oct-21	BSides Augusta 2021	Confidently Measuring Attack Technique Coverage by Asking Better Questions
3-Dec-20	CONverge Detroit	Keynote: Improving the Landscape and Messaging of Offensive Tooling and Techniques
6-Sep-19	DerbyCon IX	How do I detect technique X in Windows? Applied Methodology to Definitively Answer this Question
30-Jun-19	REcon 2019	Using WPP and TraceLogging Tracing to Facilitate Dynamic and Static Windows RE
7-Aug-18	Black Hat USA 2018	Subverting Sysmon: Application of a Formalized Security Product Evasion Methodology
15-Mar-18	TROOPERS18	Subverting Trust in Windows
23-Jan-18	BlueHat IL 2018	Hi, My Name is 'CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US'
7-Nov-17	Crowdstrike Fal.Con Unite 2017	Subverting & Restoring Trust in Windows
22-Mar-17	TROOPERS17	Architecting a Modern Defense using Device Guard
22-Sep-17	DerbyCon VII	Keynote: Subverting Trust in Windows - A Case Study of the "How" and "Why" of Engaging in Security Research
24-Jan-17	BlueHat IL 2017	Device Guard Attack Surface, Bypasses, and Mitigations
3-May-17	PowerShell Conference EU 2017	Defensive Coding Strategies for a High-Security Environment
3-May-17	PowerShell Conference EU 2017	Architecting a Modern Defense Using Device Guard and PowerShell
24-Sep-16	DerbyCon 6.0	Living Off the Land 2: A Minimalist's Guide to Windows Defense
12-Jan-16	Microsoft BlueHat v15	Windows Management Instrumentation – The Omnipresent Attack and Defense Platform
8-Aug-15	DEF CON 23	WhyMI so Sexy? WMI Attacks, Real-Time Defense, and Advanced Forensic Analysis
5-Aug-15	Black Hat USA 2015	Abusing Windows Management Instrumentation (WMI) to Build a Persistent, Asynchronous, and Fileless Backdoor
27-May-15	Microsoft BlueHat Briefing Day (Internal Conference)	Offensive PowerShell: Scripting Past Network Defenses
13-Jan-15	ShmooCon Epilogue 2015	Automating Obfuscated .NET Malware Analysis
7-Oct-14	MIRcon 2014	Analysis of Malicious Security Support Provider DLLs
28-Apr-14	PowerShell Summit 2014	Using PowerShell as a Reverse Engineering Tool
28-Apr-14	PowerShell Summit 2014	Advanced PowerShell Eventing Scripting Techniques
28-Sep-13	DerbyCon 3	Living Off The Land: A Minimalist's Guide To Windows Post Exploitation
26-Mar-13	#misec PowerShell Study Group	Parsing Binary File Formats with PowerShell

Blog Posts

Topic: Detection

• When MFA isn’t an option: The legacy of ROPC
• Better know a data source: Antimalware Scan Interface
• Better know a data source: Process command line
• Diary of a Detection Engineer: Babysitting child processes
• The why, what, and how of threat research
• Testing adversary technique variations with AtomicTestHarnesses
• What is it that Makes a Microsoft Executable a Microsoft Executable? An Attacker’s and a Defender’s Perspective
• Working With Sysmon Configurations Like a Pro Through Better Tooling

Topic: Windows Defender Application Control (WDAC)

• Steering clear of bad drivers: How to apply Microsoft's recommended driver block rules
• Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure Windows-only Policy
• Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe
• Application Whitelisting Bypass and Arbitrary Unsigned Code Execution Technique in winrm.vbs
• Threat Detection using Windows Defender Application Control (Device Guard) in Audit Mode
• Assessing the Effectiveness of Hash-based Application Whitelisting Blacklist Rules
• Adventures in Extremely Strict Device Guard Policy Configuration Part 1 — Device Drivers
• Bypassing Application Whitelisting with runscripthelper.exe
• Exploiting PowerShell Code Injection Vulnerabilities to Bypass Constrained Language Mode
• Bypassing Device Guard with .NET Assembly Compilation Methods
• Updating Device Guard Code Integrity Policies
• On the Effectiveness of Device Guard User Mode Code Integrity
• Device Guard Code Integrity Policy Auditing Methodology
• Windows Device Guard Code Integrity Policy Reference
• Using Device Guard to Mitigate Against Device Guard Bypasses
• Introduction to Windows Device Guard: Introduction and Configuration Strategy
• Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
• WMI Persistence using wmic.exe

Topic: Code Signing

• Does signed mean trusted? The Mimikatz dilemma
• Subverting X509Certificate.Equals in .NET
• Code Signing Certificate Cloning Attacks and Defenses
• Application of Authenticode Signatures to Unsigned Code

Topic: Windows Tradecraft

• Abusing PowerShell Desired State Configuration for Lateral Movement
• Writing Optimized Windows Shellcode in C
• Windows RT ARMv7-based Shellcode Development
• Windows File Confusion: Masquerading Unsigned Binaries as Signed Ones

Topic: Reverse Engineering

• Security Descriptor Auditing Methodology: Investigating Event Log Security
• Antimalware Scan Interface Detection Optics Analysis Methodology: Identification and Analysis of AMSI for WMI
• Data Source Analysis and Dynamic Windows RE using WPP and TraceLogging
• Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology
• mavinject.exe Functionality Deconstructed

Topic: Miscellaneous

• Improving Infosec (or any Community/Industry) in One Simple but Mindful Step

Attributed CVEs

CVE	Description
CVE-2023-28228	Windows Spoofing Vulnerability
CVE-2022-35743	Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
CVE-2020-1599	Windows Spoofing Vulnerability
CVE-2019-0733	Windows Defender Application Control Security Feature Bypass Vulnerability
CVE-2019-0627	Windows Security Feature Bypass Vulnerability
CVE-2018-8222	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2018-8221	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2018-8211	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2018-8204	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2018-8200	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2018-0854	Windows Security Feature Bypass Vulnerability
CVE-2017-0219	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2017-0218	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2017-0216	Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
CVE-2016-3346	Windows Permissions Enforcement Elevation of Privilege Vulnerability