Ever Present Persistence - Established Footholds Seen in the Wild

No ratings

Presented at BSidesNashville 2016 by

Evan Peña

Chris Truncer

Penetration tests don’t commonly require testers to establish a long-term presence within a network, but that’s not how the real world works. Unless you’re facing an insider threat, you have to come to the realization that once attackers get in, they’re likely going to install some form of persistence that will grant nearly (if-not) on-demand access into your network. This talk will document a variety of different persistence techniques that we’ve seen in the wild ranging from your dollar store capability to those that are highly engineered. We want you to learn the different techniques we’ve seen so you can recreate them, or hunt for them in your network.