Catch Me If You Can: Stealthy Backdoor Deployment & Enterprise Persistence
Eduardo Arriols breaks down stealthy backdoor deployment and persistent access techniques across enterprise Windows networks, evading blue team hunts.
Summary
The Critical Challenge of Long-Term Persistence
Maintaining reliable, covert access during extended red team engagements requires deploying diverse persistence mechanisms that withstand reboots and blue team remediation.
Categorizing Modern Enterprise Persistence Mechanisms
Eduardo Arriols examines various persistence locations—including scheduled tasks, WMI event subscriptions, service creation, and registry run keys.
Implementing Stealthy C2 Channels and Fallback Implants
The author demonstrates configuring redundant, low-and-slow command and control (C2) implants that wake up periodically to avoid behavioral detection.
Blue Team Threat Hunting and Persistence Auditing
The presentation provides defenders with telemetry inspection checklists, AutoRuns analysis workflows, and detection heuristics to root out hidden implants.
Related talks
Red Team Village·38 min
An introduction and technical overview of CyberWraith, the Red Team Village's open-source command-and-control and engagement infrastructure platform.
Red Team Village·1 hr
Sajal Thomas
Sajal Thomas examines the technical gap between commercial red teams and state-sponsored APT groups, sharing advanced tradecraft to elevate offensive testing.
Red Team Village·23 min
Álvaro Rueda
Álvaro Rueda explores covert egress techniques and data exfiltration channels designed to bypass strict enterprise perimeter firewalls and DLP sensors.