Advanced Red Teaming Techniques: Malware Authoring and Repurposing

Course Description

Malware techniques used to perform malicious actions are often similar to those used by antivirus and security products. Understanding how to write and design malware helps security analysts rapidly identify patterns of code when investigating a malicious binary.

Knowing how to design and develop each part of a payload enables red team members to reuse, debug, fix, or rewrite a solution.

Students will learn how to produce a shellcode blob capable of loading and injecting multiple malicious binaries via techniques repurposed from existing malicious samples. This course includes APIs and techniques used to perform common malicious functionality and extends these techniques to produce reliable payloads that function across operating system versions and limit exposure to security products.

The hands-on labs for this course are development-focused through use of C and Intel Assembly.

Learning Objectives

After completing this course, learners should be able to:

• Develop malicious applications using the Windows SDK
• Create position independent code (PIC) using C and Intel Assembly
• Write malicious code to perform code injection and modify a running application in-memory
• Analyze and modify a malicious binary to reuse functionality
• Design and write reliable payloads across a variety of operating system versions
• Use proven techniques to execute injections, hooking, and fingerprinting across various systems

Who should attend

Software developers, information security professionals, incident responders, computer security researchers, corporate investigators and others who require an understanding of malware inner workings, crafting reliable shellcode and payloads, and rapid repurposing of malware samples.

Prerequisites

Advanced knowledge of computer and operating system fundamentals and Windows internals. Familiarity with reverse engineering, Windows SDK and proficiency at developing in C is recommended.

Delivery method

In-classroom instructor-led training

Duration

• 5 days

What to bring

Students are required to bring their own laptop that meets the following specs:

• VMware Workstation Pro 12.5 or newer (installed with the ability to run a VM)
• At least 30 GB of free HDD space