Matt Hand

Evading EDR

The Definitive Guide to Defeating Endpoint Detection Systems

• Broschiertes Buch

Produktbeschreibung

"Introduces readers to the most common components of EDR systems, including function hooking, callback notifications, Event Tracing for Windows, and filesystem minifilters, by explaining how they are implemented and how they collect various data points. Covers documented evasion strategies for bypassing detections and describes how defenders might protect themselves"--

Produktdetails

• Verlag: No Starch Press, US
• Erscheinungstermin: 31. Oktober 2023
• Englisch
• Abmessung: 236mm x 183mm x 22mm
• Gewicht: 620g
• ISBN-13: 9781718503342
• ISBN-10: 1718503342
• Artikelnr.: 67739805

Autorenporträt

Matt Hand

Inhaltsangabe

Introduction
Chapter 1: EDR-chitecture
Chapter 2: Function-Hooking DLLs
Chapter 3: Thread and Process Notifications
Chapter 4: Object Notifications
Chapter 5: Image-Load and Registry Notifications
Chapter 6: Minifilters
Chapter 7: Network Filter Drivers
Chapter 8: Event Tracing for Windows
Chapter 9: Scanners
Chapter 10: Anti-Malware Scan Interface
Chapter 11: Early Launch Anti-Malware Drivers
Chapter 12: Microsoft-Windows-Threat-Intelligence
Chapter 13: A Detection-Aware Attack
Appendix