Lifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats

...In this talk, we will present how defenders and analysts can utilize these features in Windows to track and defend against RPC-based attacks. We will also demonstrate their effectiveness in analyzing RPC data and detecting malicious traffic. Finally, we will share signatures that we wrote to detect many common lateral movement techniques and one-days.... By: Stiv Kupchik Full Abstract and Presentation Materials: #lifting-the-fog-of-war---monitoring-identifying-and-mitigating-ms-rpc-based-threats-32792