{"product_id":"get-away-with-malware-dimitri-di-cristofaro-and-giorgio-bernardinetti-sg2027","title":"How to Get Away with Malware: From EDR Internals to AI assisted Malware Operations - Dimitri Di Cristofaro and Giorgio Bernardinetti - DCTSG2027","description":"\u003cp\u003e\u003cstrong\u003eName of Training:\u003c\/strong\u003e \u003cmeta charset=\"utf-8\"\u003e\u003cspan\u003eHow to Get Away with Malware: From EDR Internals to AI assisted Malware Operations \u003c\/span\u003e\u003cbr\u003e\u003cstrong\u003eTrainer(s):\u003c\/strong\u003e Dimitri Di Cristofaro and Giorgio Bernardinetti\u003cbr\u003e\u003cstrong\u003eSkill Level:\u003c\/strong\u003e Intermediate\u003cbr\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e March 5 – March 7, 2027\u003cbr\u003e\u003cstrong\u003eTime:\u003c\/strong\u003e 9 to 5 pm\u003cbr\u003e\u003cstrong\u003eVenue:\u003c\/strong\u003e TBD\u003cbr\u003e\u003cstrong\u003eEarly Bird Cost:\u003c\/strong\u003e S$3,300 \u003cmeta charset=\"utf-8\"\u003e(incl. GST, until Dec 31, 2026)\u003cbr\u003e\u003cstrong\u003eRegular Cost:\u003c\/strong\u003e S$3,600 (incl. GST)\u003c\/p\u003e\n\u003ch3\u003eShort Summary\u003c\/h3\u003e\n\u003cp\u003eThis hands-on training is an intensive, hands-on course designed to go through the entire malware lifecycle from initial access to advanced in-memory evasion and kernel-level persistence, with the help of AI. The goal of the course is to cultivate a research-driven mindset, enabling attendees to understand and analyze detection strategies provided by the Windows OS, dig into the internals of EDR architectures and finally craft their own techniques to evade them effectively.\u003c\/p\u003e\n\u003ch3\u003eCourse Description\u003c\/h3\u003e\n\u003cp\u003eThis intensive three-day training provides an end-to-end exploration of Windows malware operations, from user-space initial access through advanced in-memory evasion techniques and kernel-level persistence. You'll examine how Windows security mechanisms and EDR platforms detect suspicious activity, then apply that understanding to design and evaluate custom techniques in a controlled lab environment. A key focus of the course is cultivating a research-driven mindset: analyzing detection strategies, testing assumptions, and engineering custom tailored solutions rather than simply applying known tradecraft.\u003c\/p\u003e\n\u003cp\u003eThe first modules focus heavily on user-space evasion, providing a systematic approach to memory management and process manipulation, learning how to bypass modern detection mechanisms and develop stealthy user-space malware components. Through live demonstrations and hands-on exercises, you'll learn how individual techniques combine into practical C2 and implant architectures capable of bypassing even modern detection systems. By the end of the first part of the training, you'll develop a strong understanding of the underlying mechanisms used in malware development and C2 payload architectures, along with the techniques used to assess their detection and evasion capabilities.\u003c\/p\u003e\n\u003cp\u003eThe final modules move into kernel-level offensive tool development, where you'll explore advanced methods to evade EDR sensors and subvert telemetry collection, gaining a deeper understanding of how to operate in highly monitored environments. You’ll learn how to discover real-world vulnerable drivers using open community resources like loldrivers, apply BYOVD methodologies, and leverage AI-assisted reverse engineering with MCPs to analyze binaries and find exploitable behaviors.\u003c\/p\u003e\n\u003cp\u003eBy the end of the course, you’ll have built and tested a functional full-chain malware in a lab environment, gained practical skills in user-space evasion, driver reversing, primitive weaponization, and AI-driven exploitation, all while understanding the defensive implications of these techniques.\u003c\/p\u003e\n\u003ch3\u003eCourse Outline\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003eDay 1 - Morning\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eAdvanced Windows internals:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eWhat happens when Windows executes a PE file?\u003c\/li\u003e\n\u003cli\u003eWindows internals: TEB\/PEB\u003c\/li\u003e\n\u003cli\u003ePrimer on Windows loader structure\u003c\/li\u003e\n\u003cli\u003eWrite your custom PE loader\u003c\/li\u003e\n\u003cli\u003e[exercise] Write your own PEB walker to retrieve functions from NTDLL (and more)\u003c\/li\u003e\n\u003cli\u003eUseful information we can retrieve from TEB\/PEB for evasion\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 1 - Afternoon\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eBackground on detection techniques:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eState of the art detection strategies\u003c\/li\u003e\n\u003cli\u003eStatic\/Dynamic, Kernel Callbacks, ETW-Ti, minifilters, AMSI, API hooking, call stack analysis, memory scan, …\u003c\/li\u003e\n\u003cli\u003eHow EDRs collect telemetry from these sources\u003c\/li\u003e\n\u003cli\u003eNB: This will be an introduction to give students an high level idea of the concepts, the relevant details will be showcased during the whole course sections.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eEvasion part 1:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe goal of “code execution”\u003c\/li\u003e\n\u003cli\u003eMemory allocation, Memory writing, Memory execution\u003c\/li\u003e\n\u003cli\u003eLocal\/Remote code execution\u003c\/li\u003e\n\u003cli\u003eMemory allocation vs EDRs\u003c\/li\u003e\n\u003cli\u003eOverview of basic\/advanced existing techniques + IoCs\u003c\/li\u003e\n\u003cli\u003eModule Overloading + PEB + avoid kernel callbacks\u003c\/li\u003e\n\u003cli\u003e[Exercise: module overloading]\u003c\/li\u003e\n\u003cli\u003eMemory Scanners demo\u003c\/li\u003e\n\u003cli\u003eMoneta\u003c\/li\u003e\n\u003cli\u003ePE-sieve\u003c\/li\u003e\n\u003cli\u003eMemory writing vs EDRs\u003c\/li\u003e\n\u003cli\u003eMemory execution vs EDRs\u003c\/li\u003e\n\u003cli\u003eOverview of basic\/advanced existing techniques + IoCs\u003c\/li\u003e\n\u003cli\u003e32 bit execution in 64 bit systems - Heaven’s gate\u003c\/li\u003e\n\u003cli\u003eUserspace ETW bypasses\u003c\/li\u003e\n\u003cli\u003eMemory patching\u003c\/li\u003e\n\u003cli\u003eHardware Breakpoints\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 2 - Morning\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eMemory execution vs EDRs\u003c\/li\u003e\n\u003cli\u003eAdvanced techniques + implementation in demos\u003c\/li\u003e\n\u003cli\u003e[Demos: threadless inject, early cascade, thread pool injection]\u003c\/li\u003e\n\u003cli\u003ethread pool pitfalls - stability issues caused by remote thread pool injection\u003c\/li\u003e\n\u003cli\u003e[exercise: Fix crashes of thread pool injection]\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eEvasion part 2:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eSleep Masking\u003c\/li\u003e\n\u003cli\u003eSleep Masking Basic\u003c\/li\u003e\n\u003cli\u003eSleep Masking using Thread pools + ROP\u003c\/li\u003e\n\u003cli\u003eCET exploit protection\u003c\/li\u003e\n\u003cli\u003eCall Stack Spoofing\u003c\/li\u003e\n\u003cli\u003eUnderlying issues: kernel callbacks, call stack analysis, API hooking\u003c\/li\u003e\n\u003cli\u003eRE of Detours open source hooking library\u003c\/li\u003e\n\u003cli\u003eRE of proprietary hooking library\u003c\/li\u003e\n\u003cli\u003eAPI unhooking\n\u003cul\u003e\n\u003cli\u003e[+ demo]\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/li\u003e\n\u003cli\u003eDirect\/Indirect syscalls\n\u003cul\u003e\n\u003cli\u003e[+ exercise]\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/li\u003e\n\u003cli\u003eCET compliant indirect syscalls using Thread Pool and Windows API callbacks\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 2 - Afternoon\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eDotnet\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003ePrimer on dotnet internals\u003c\/li\u003e\n\u003cli\u003eC# interop with C++ (IJW)\u003c\/li\u003e\n\u003cli\u003eAMSI bypasses: memory patching and HW Breakpoints\u003c\/li\u003e\n\u003cli\u003eCall native code in C#\u003c\/li\u003e\n\u003cli\u003edemo: SharpASM\u003c\/li\u003e\n\u003cli\u003edemo: SharpWhispers\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eFinal user-space demo\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eCombine memory allocation, writing and execution + unhooking, syscalls with thread pools for a fully-stealth user-space PoC\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePrivilege Escalation techniques\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eUAC bypass\u003c\/li\u003e\n\u003cli\u003eHandle stealing\u003c\/li\u003e\n\u003cli\u003eExercise: Write an handle stealer\u003c\/li\u003e\n\u003cli\u003eEDR telemetry on privilege escalation\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 3 - Morning\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eMinifilter drivers for telemetry\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eArchitecture, altitude\u003c\/li\u003e\n\u003cli\u003ePre\/post operation Callbacks\u003c\/li\u003e\n\u003cli\u003eSelf-protection\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eKernel evasion \u0026amp; persistence:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eKernel space evasion \u0026amp; persistence\u003c\/li\u003e\n\u003cli\u003eKernel drivers vs DSE\u003c\/li\u003e\n\u003cli\u003eBring your own Driver\u003c\/li\u003e\n\u003cli\u003eDSE\u003c\/li\u003e\n\u003cli\u003eEDR telemetry\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eInstall your driver (BYOVD):\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003ePrimitive to Capability\n\u003cul\u003e\n\u003cli\u003eAchieving full virtual and physical memory R\/W\u003c\/li\u003e\n\u003cli\u003eMapping physical \u0026lt;-\u0026gt; virtual addresses\u003c\/li\u003e\n\u003cli\u003eWhy virtual and physical R\/W are equivalent in practice\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003epost-BYOVD exploitation and EDR tampering:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eAbusing process handles for privilege escalation\u003c\/li\u003e\n\u003cli\u003eManipulating kernel callbacks\u003c\/li\u003e\n\u003cli\u003eTampering with PPL attributes\u003c\/li\u003e\n\u003cli\u003eForcing crashes in target processes\u003c\/li\u003e\n\u003cli\u003eAdditional primitive applications (tamper with all kernel-based telemetry)\u003c\/li\u003e\n\u003cli\u003eKernel to user DLL injection\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e[+demo]\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eDay 3 - Afternoon\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eBuilding a Working Chain\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eUsing LLMs to generate templates\u003c\/li\u003e\n\u003cli\u003eIntegrating weaponized primitives into a payload\u003c\/li\u003e\n\u003cli\u003eIterative testing and crash analysis (expect BSODs) [+demo + exercise]\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eEnhanced Remote Debugging with MCPs\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eIntegrating MCPs for LLM-assisted remote kernel debugging\u003c\/li\u003e\n\u003cli\u003eEnvironment setup:\u003c\/li\u003e\n\u003cli\u003eConfiguring WinDbg with MCP\u003c\/li\u003e\n\u003cli\u003eLinking host, target VM, and LLM via MCP for real-time analysis\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDifficulty Level\u003c\/h4\u003e\n\u003cp\u003eIntermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.\u003c\/p\u003e\n\u003ch3\u003eSuggested Prerequisites\u003c\/h3\u003e\n\u003cp\u003eGeneral prerequisites:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003ePrevious knowledge of Windows internals is required (processes, threads, virtual memory, ...)\u003c\/li\u003e\n\u003cli\u003eC\/C++ knowledge. It is required to have knowledge on direct memory manipulation (e.g. pointers, casting, endianess, etc...).\u003c\/li\u003e\n\u003cli\u003eBasic x86 ASM knowledge.\u003c\/li\u003e\n\u003cli\u003eFamiliarity with debuggers is preferred.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eSuggested material:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Internals Crash Course: https:\/\/www.youtube.com\/watch?v=I_nJltUokE0\u003c\/li\u003e\n\u003cli\u003eLife Of Binaries course: https:\/\/opensecuritytraining.info\/LifeOfBinaries.html\u003c\/li\u003e\n\u003cli\u003eHello Assembly!: https:\/\/www.youtube.com\/watch?v=el5V__08k_4\u003c\/li\u003e\n\u003cli\u003eSimple Function Hooking: https:\/\/www.youtube.com\/watch?v=TxBGBz7FRyk\u003c\/li\u003e\n\u003cli\u003eHooking Functions in a different process: https:\/\/www.youtube.com\/watch?v=7vKaet7hHeY\u003c\/li\u003e\n\u003cli\u003eInjecting DLL with Shellcode: https:\/\/www.youtube.com\/watch?v=SmFi1cj6gMg\u003c\/li\u003e\n\u003cli\u003eDLL Injection with CreateRemoteThread: https:\/\/www.youtube.com\/watch?v=0jX9UoXYLa4\u003c\/li\u003e\n\u003cli\u003eDLL Injection with QueueUserAPC: https:\/\/www.youtube.com\/watch?v=RBCR9Gvp5BM\u003c\/li\u003e\n\u003cli\u003eIntroduction to ETW: https:\/\/www.youtube.com\/watch?v=-i_xAF7JqyA\u003c\/li\u003e\n\u003cli\u003eDrivers And Devices (part 1): https:\/\/www.youtube.com\/watch?v=sSZ8jnpUCi0\u003c\/li\u003e\n\u003cli\u003eDrivers And Devices (part 2): https:\/\/www.youtube.com\/watch?v=6_FU3zdPCmc\u003c\/li\u003e\n\u003cli\u003eCreate your first Hello World driver: https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/gettingstarted\/writing-a-very-small-kmdf--driver\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eWhat Students Should Bring\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSubscription to Claude Code\u003c\/li\u003e\n\u003cli\u003eLaptop with virtualization software compatible with .ova (e.g. VMWare workstation, VirtualBox). It is recommended to use VMWare.\u003c\/li\u003e\n\u003cli\u003eMinimum requirements:\u003c\/li\u003e\n\u003cli\u003eCPU cores: 4 (8 recommended)\u003c\/li\u003e\n\u003cli\u003eRAM: 16 GB (32 GB recommended)\u003c\/li\u003e\n\u003cli\u003eDisk: 500 GB (1 TB recommended)\u003c\/li\u003e\n\u003cli\u003eIf your host is Windows, you have the option to install the development and debugging environment on either your host or on one of the two provided VMs. If your host is Linux\/MacOS, you must use both the two provided VMs for development and debugging.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePlease note that M* ARM Mac processors are not supported. We are going to delve into x86 assembly, so please make sure to have an x86 laptop.\u003c\/p\u003e\n\u003ch3\u003eWhat the Trainer Will Provide\u003c\/h3\u003e\n\u003cp\u003eDuring the training, students will be provided with:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eA Virtual Machine with the development environment configured\u003c\/li\u003e\n\u003cli\u003eA Virtual Machine to be used as target for driver exploitation\u003c\/li\u003e\n\u003cli\u003eTemplates for exercises\u003c\/li\u003e\n\u003cli\u003eExercises solutions\u003c\/li\u003e\n\u003cli\u003eAll tools used for the training\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eTrainer(s) Bio\u003c\/h3\u003e\n\u003cp\u003eDimitri \"GlenX\" Di Cristofaro is a senior Technical Lead and researcher at SECFORCE LTD where he performs Red Teams on a daily basis.\u003cbr\u003eThe main focus of his research activities is about Red Teaming and in particular on identifying new ways of attacking operating systems and looking for cutting edge techniques to increase stealthiness in strictly monitored environments.\u003cbr\u003eHe enjoys malware writing and offensive tools development as well as producing electronic music in his free time.\u003c\/p\u003e\n\u003cp\u003eGiorgio \"gbyolo\" Bernardinetti is a Senior Windows Security Researcher at SentinelOne, digging into kernel-level EDR tampering techniques and user\/kernel OS exploits.\u003cbr\u003eHis background includes security research focused on red team support activities, mainly user-space malware techniques. Alongside his security work, he spent time in academia teaching cybersecurity courses at graduate and post-graduate levels.\u003cbr\u003eHe has been a speaker for DEFCON32 Workshops and Red Team Village HacktivityCon 2021, and instructor for DEF CON Trainings in Las Vegas (2025) and Singapore (2026).\u003c\/p\u003e\n\u003ch3\u003eProficiency Exam\u003c\/h3\u003e\n\u003cp\u003eProficiency evaluation for this training is integrated in the course via the various exercises that attendees must solve before moving to the next part, as well as many practical demonstrations on how to adapt and apply the research mindset to existing projects and improve them or fit for specific use cases.\u003c\/p\u003e\n\u003chr\u003e\n\u003csection class=\"registration-terms\"\u003e\n\u003ch3\u003eRegistration Terms and Conditions\u003c\/h3\u003e\n\u003cp\u003eTrainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eBetween January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eAll trainings are non-refundable after Feb 28, 2027.\u003c\/p\u003e\n\u003cp\u003eTraining tickets may be transferred to another student. Please email us at training@defcon.org for specifics.\u003c\/p\u003e\n\u003cp\u003eIf a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/p\u003e\n\u003cp\u003eFailure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/p\u003e\n\u003cp\u003eDEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/p\u003e\n\u003cp\u003eBy purchasing this ticket you agree to abide by the \u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003eDEF CON Training Code of Conduct\u003c\/a\u003e and the registration terms and conditions listed above.\u003c\/p\u003e\n\u003cp\u003eSeveral breaks will be included throughout the day. Please note that food is not included.\u003c\/p\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eAll courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.\u003c\/p\u003e\n\u003c\/section\u003e","brand":"Singapore 2027","offers":[{"title":"Default Title","offer_id":63496775139468,"sku":null,"price":3300.0,"currency_code":"SGD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0750\/9042\/8044\/files\/Giorgio-Dimitri.jpg?v=1768361728","url":"https:\/\/sg.shop.defcon.org\/products\/get-away-with-malware-dimitri-di-cristofaro-and-giorgio-bernardinetti-sg2027","provider":"DEF CON SG","version":"1.0","type":"link"}