How to Get Away with Malware: From EDR Internals to AI assisted Malware Operations - Dimitri Di Cristofaro and Giorgio Bernardinetti - DCTSG2027
Description
Name of Training: How to Get Away with Malware: From EDR Internals to AI assisted Malware Operations
Trainer(s): Dimitri Di Cristofaro and Giorgio Bernardinetti
Skill Level: Intermediate
Dates: March 5 – March 7, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$3,300 (incl. GST, until Dec 31, 2026)
Regular Cost: S$3,600 (incl. GST)
Short Summary
This hands-on training is an intensive, hands-on course designed to go through the entire malware lifecycle from initial access to advanced in-memory evasion and kernel-level persistence, with the help of AI. The goal of the course is to cultivate a research-driven mindset, enabling attendees to understand and analyze detection strategies provided by the Windows OS, dig into the internals of EDR architectures and finally craft their own techniques to evade them effectively.
Course Description
This intensive three-day training provides an end-to-end exploration of Windows malware operations, from user-space initial access through advanced in-memory evasion techniques and kernel-level persistence. You'll examine how Windows security mechanisms and EDR platforms detect suspicious activity, then apply that understanding to design and evaluate custom techniques in a controlled lab environment. A key focus of the course is cultivating a research-driven mindset: analyzing detection strategies, testing assumptions, and engineering custom tailored solutions rather than simply applying known tradecraft.
The first modules focus heavily on user-space evasion, providing a systematic approach to memory management and process manipulation, learning how to bypass modern detection mechanisms and develop stealthy user-space malware components. Through live demonstrations and hands-on exercises, you'll learn how individual techniques combine into practical C2 and implant architectures capable of bypassing even modern detection systems. By the end of the first part of the training, you'll develop a strong understanding of the underlying mechanisms used in malware development and C2 payload architectures, along with the techniques used to assess their detection and evasion capabilities.
The final modules move into kernel-level offensive tool development, where you'll explore advanced methods to evade EDR sensors and subvert telemetry collection, gaining a deeper understanding of how to operate in highly monitored environments. You’ll learn how to discover real-world vulnerable drivers using open community resources like loldrivers, apply BYOVD methodologies, and leverage AI-assisted reverse engineering with MCPs to analyze binaries and find exploitable behaviors.
By the end of the course, you’ll have built and tested a functional full-chain malware in a lab environment, gained practical skills in user-space evasion, driver reversing, primitive weaponization, and AI-driven exploitation, all while understanding the defensive implications of these techniques.
Course Outline
View full outline
Hide outline
Day 1 - Morning
Advanced Windows internals:
- What happens when Windows executes a PE file?
- Windows internals: TEB/PEB
- Primer on Windows loader structure
- Write your custom PE loader
- [exercise] Write your own PEB walker to retrieve functions from NTDLL (and more)
- Useful information we can retrieve from TEB/PEB for evasion
Day 1 - Afternoon
Background on detection techniques:
- State of the art detection strategies
- Static/Dynamic, Kernel Callbacks, ETW-Ti, minifilters, AMSI, API hooking, call stack analysis, memory scan, …
- How EDRs collect telemetry from these sources
- NB: This will be an introduction to give students an high level idea of the concepts, the relevant details will be showcased during the whole course sections.
Evasion part 1:
- The goal of “code execution”
- Memory allocation, Memory writing, Memory execution
- Local/Remote code execution
- Memory allocation vs EDRs
- Overview of basic/advanced existing techniques + IoCs
- Module Overloading + PEB + avoid kernel callbacks
- [Exercise: module overloading]
- Memory Scanners demo
- Moneta
- PE-sieve
- Memory writing vs EDRs
- Memory execution vs EDRs
- Overview of basic/advanced existing techniques + IoCs
- 32 bit execution in 64 bit systems - Heaven’s gate
- Userspace ETW bypasses
- Memory patching
- Hardware Breakpoints
Day 2 - Morning
- Memory execution vs EDRs
- Advanced techniques + implementation in demos
- [Demos: threadless inject, early cascade, thread pool injection]
- thread pool pitfalls - stability issues caused by remote thread pool injection
- [exercise: Fix crashes of thread pool injection]
Evasion part 2:
- Sleep Masking
- Sleep Masking Basic
- Sleep Masking using Thread pools + ROP
- CET exploit protection
- Call Stack Spoofing
- Underlying issues: kernel callbacks, call stack analysis, API hooking
- RE of Detours open source hooking library
- RE of proprietary hooking library
- API unhooking
- [+ demo]
- Direct/Indirect syscalls
- [+ exercise]
- CET compliant indirect syscalls using Thread Pool and Windows API callbacks
Day 2 - Afternoon
Dotnet
- Primer on dotnet internals
- C# interop with C++ (IJW)
- AMSI bypasses: memory patching and HW Breakpoints
- Call native code in C#
- demo: SharpASM
- demo: SharpWhispers
Final user-space demo
- Combine memory allocation, writing and execution + unhooking, syscalls with thread pools for a fully-stealth user-space PoC
Privilege Escalation techniques
- UAC bypass
- Handle stealing
- Exercise: Write an handle stealer
- EDR telemetry on privilege escalation
Day 3 - Morning
Minifilter drivers for telemetry
- Architecture, altitude
- Pre/post operation Callbacks
- Self-protection
Kernel evasion & persistence:
- Kernel space evasion & persistence
- Kernel drivers vs DSE
- Bring your own Driver
- DSE
- EDR telemetry
Install your driver (BYOVD):
- Primitive to Capability
- Achieving full virtual and physical memory R/W
- Mapping physical <-> virtual addresses
- Why virtual and physical R/W are equivalent in practice
post-BYOVD exploitation and EDR tampering:
- Abusing process handles for privilege escalation
- Manipulating kernel callbacks
- Tampering with PPL attributes
- Forcing crashes in target processes
- Additional primitive applications (tamper with all kernel-based telemetry)
- Kernel to user DLL injection
[+demo]
Day 3 - Afternoon
Building a Working Chain
- Using LLMs to generate templates
- Integrating weaponized primitives into a payload
- Iterative testing and crash analysis (expect BSODs) [+demo + exercise]
Enhanced Remote Debugging with MCPs
- Integrating MCPs for LLM-assisted remote kernel debugging
- Environment setup:
- Configuring WinDbg with MCP
- Linking host, target VM, and LLM via MCP for real-time analysis
Difficulty Level
Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.
Suggested Prerequisites
General prerequisites:
- Previous knowledge of Windows internals is required (processes, threads, virtual memory, ...)
- C/C++ knowledge. It is required to have knowledge on direct memory manipulation (e.g. pointers, casting, endianess, etc...).
- Basic x86 ASM knowledge.
- Familiarity with debuggers is preferred.
Suggested material:
- Windows Internals Crash Course: https://www.youtube.com/watch?v=I_nJltUokE0
- Life Of Binaries course: https://opensecuritytraining.info/LifeOfBinaries.html
- Hello Assembly!: https://www.youtube.com/watch?v=el5V__08k_4
- Simple Function Hooking: https://www.youtube.com/watch?v=TxBGBz7FRyk
- Hooking Functions in a different process: https://www.youtube.com/watch?v=7vKaet7hHeY
- Injecting DLL with Shellcode: https://www.youtube.com/watch?v=SmFi1cj6gMg
- DLL Injection with CreateRemoteThread: https://www.youtube.com/watch?v=0jX9UoXYLa4
- DLL Injection with QueueUserAPC: https://www.youtube.com/watch?v=RBCR9Gvp5BM
- Introduction to ETW: https://www.youtube.com/watch?v=-i_xAF7JqyA
- Drivers And Devices (part 1): https://www.youtube.com/watch?v=sSZ8jnpUCi0
- Drivers And Devices (part 2): https://www.youtube.com/watch?v=6_FU3zdPCmc
- Create your first Hello World driver: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/writing-a-very-small-kmdf--driver
What Students Should Bring
- Subscription to Claude Code
- Laptop with virtualization software compatible with .ova (e.g. VMWare workstation, VirtualBox). It is recommended to use VMWare.
- Minimum requirements:
- CPU cores: 4 (8 recommended)
- RAM: 16 GB (32 GB recommended)
- Disk: 500 GB (1 TB recommended)
- If your host is Windows, you have the option to install the development and debugging environment on either your host or on one of the two provided VMs. If your host is Linux/MacOS, you must use both the two provided VMs for development and debugging.
Please note that M* ARM Mac processors are not supported. We are going to delve into x86 assembly, so please make sure to have an x86 laptop.
What the Trainer Will Provide
During the training, students will be provided with:
- A Virtual Machine with the development environment configured
- A Virtual Machine to be used as target for driver exploitation
- Templates for exercises
- Exercises solutions
- All tools used for the training
Trainer(s) Bio
Dimitri "GlenX" Di Cristofaro is a senior Technical Lead and researcher at SECFORCE LTD where he performs Red Teams on a daily basis.
The main focus of his research activities is about Red Teaming and in particular on identifying new ways of attacking operating systems and looking for cutting edge techniques to increase stealthiness in strictly monitored environments.
He enjoys malware writing and offensive tools development as well as producing electronic music in his free time.
Giorgio "gbyolo" Bernardinetti is a Senior Windows Security Researcher at SentinelOne, digging into kernel-level EDR tampering techniques and user/kernel OS exploits.
His background includes security research focused on red team support activities, mainly user-space malware techniques. Alongside his security work, he spent time in academia teaching cybersecurity courses at graduate and post-graduate levels.
He has been a speaker for DEFCON32 Workshops and Red Team Village HacktivityCon 2021, and instructor for DEF CON Trainings in Las Vegas (2025) and Singapore (2026).
Proficiency Exam
Proficiency evaluation for this training is integrated in the course via the various exercises that attendees must solve before moving to the next part, as well as many practical demonstrations on how to adapt and apply the research mindset to existing projects and improve them or fit for specific use cases.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
