Casey Smithand Matt Nelson

The modern Windows Operating System carries with it an incredible amount of legacy code. The Component Object Model (COM) has left a lasting impact on Windows. This technology is far from dead as it continues to be the foundation for many aspects of the Windows Operating System. You can find hundreds of COM Classes defined by CLSID (COM Class Identifiers). Do you know what they do? This talk seeks to expose tactics long forgotten by the modern defender. We seek to bring to light artifacts in the Windows OS that can be used for persistence. We will present novel tactics for persistence using only the registry and COM objects.

Casey Smith (@subTee) is a Researcher with the Veris Group Adaptive Threat Division. His interests include testing and understanding defensive systems. Matt Nelson (@enigma0x3) is a Red Teamer and Researcher with the Veris Group Adaptive Threat Division. Matt has a passion for offensive PowerShell, is an active developer on the PowerShell Empire project, and helps build offensive toolsets to facilitate red team engagements.

Back to BSides Nashville 2017 list