Kill Chain Reloaded: Abuse Legacy Paths for Stealth Persistence
Uncovers overlooked legacy Windows execution paths and registry mechanisms to establish stealthy persistence that evades modern EDR detection.
Summary
The Challenge of Endpoint Persistence
Modern Endpoint Detection and Response (EDR) agents rigorously monitor common persistence vectors, such as standard Run keys, scheduled tasks, and Windows services.
Rediscovering Obscure Legacy Execution Paths
A Hernando and B Martinez delve into decades of Windows architecture, identifying overlooked registry subkeys, legacy COM handler redirections, and deprecated shell extension paths that bypass EDR heuristics.
Achieving Stealthy, Unmonitored Persistence
By leveraging legitimate operating system binaries and dormant subsystem configurations, red teams can maintain durable persistence across system reboots without generating suspicious process telemetry.
Detection Engineering and Registry Auditing
Blue teams can enhance visibility by expanding behavioral registry monitoring rules, auditing dormant COM registrations, and conducting regular baseline comparisons of endpoint configuration states.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·36 min
Ron Ben Yizhak
Introduces RPC Racer, a technique that exploits race conditions in Windows RPC endpoint registration to hijack privileged system service communication.