Save Environment Variable: Hijacking Legit Apps with Minimal Footprint
Wietze Beukema presents novel DLL hijacking techniques that manipulate user-controlled environment variables to execute code via signed binaries with zero file drops.
Summary
The Maturation of Classic DLL Hijacking Defenses
Endpoint Detection and Response (EDR) solutions have extensively mapped standard DLL search order hijacking, making traditional binary planting detectable.
Discovering Environment Variable DLL Dependencies
Wietze Beukema investigates how legitimate, digitally signed Windows executables expand user-controllable environment variables to resolve dependency paths.
Executing Payloads with Minimal Forensics Footprints
Beukema demonstrates setting arbitrary environment variables to steer trusted system binaries into loading malicious DLLs from atypical locations without modifying system files.
Detection Strategies for Hunting Anomalous DLL Loads
The author provides incident responders with Sigma detection rules and telemetry queries to detect suspicious environment variable manipulations.
Related talks
Main Stage·16 min
Scott Taylor
Scott Taylor introduces C4, an open-source framework decoupling payload implants from command-and-control protocols using versatile external connectors.
Main Stage·26 min
Tarek Abdelmotaleb · Bramwell Brizendine
Tarek Abdelmotaleb and Dr. Bramwell Brizendine demonstrate weaponizing Windows syscalls into pure position-independent shellcode, evading modern EDR hooks.
Main Stage·47 min
Dimitry Snezhkov
Presents advanced C2 communication obfuscation techniques that blend malicious traffic into legitimate business protocols.