1. SIM310

5. 1) “Malware Author’ grows BOTNET & makes available to “buyers” 2) Access is purchased via ‘MarketPlace’ 4) BOTNET attacks seen at multiple entry points 5) BOTNET also serves to ‘recruit’ additional BOTs 3) BOTNET use granted

9. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

10. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

11. Firewall & Configuration Management Malware Response “MMPC Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

12. HANDLE hFile; hFile = CreateFile(L"NewVirus.exe", GENERIC_WRITE, 0, NULL, CREATE_NEW, FILE_ATTRIBUTE_HIDDEN, NULL);... push 40000000h push offset string L"NewVirus.exe” call dword ptr [__imp__CreateFileW@28] cmp esi,esp... push 40000000h push offset string L"NewVirus.exe” call dword ptr [DT_CreateFile] cmp esi,esp DT

13. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

14. Filesystem FileCreate FileOpen FileModify FileDelete FileRename Filesystem FileCreate FileOpen FileModify FileDelete FileRename Registry RegistryKeyCreate RegistrySetValue RegistryKeyDelete RegistryValueDelete RegistryKeyRename Registry RegistryKeyCreate RegistrySetValue RegistryKeyDelete RegistryValueDelete RegistryKeyRename Network IRC Network IRC Other ModuleLoad ProcessCreate OpenProcess ProcessTerminate DriverLoad BootSectorChange RemoteThreadInject RawWrite Other ModuleLoad ProcessCreate OpenProcess ProcessTerminate DriverLoad BootSectorChange RemoteThreadInject RawWrite Good for detecting droppers and file infectors Good for ASEPS and detecting tampering with software keys and configuration. Good for detecting process infectors and exploits Good for detecting process infectors and exploits Good for detecting rootkit installers Good for detecting IRC bots

15. FILTER for EVENTS: Ignore if the program the process is running has a clean file reputation (Or driver in the kernel tampering case.) FILTER for EVENTS: Ignore if the program the process is running has a clean file reputation (Or driver in the kernel tampering case.)

17. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Vulnerability Shielding

18. demo

19. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

23. demo

25. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

26. demo

27. Firewall & Configuration Management Malware Response “MMPC” Generics and Heuristics Antimalware Behavior Monitoring Dynamic Signature Service Anti-Rootkit Network Vulnerability Shielding

28. Anti-Rootkit Generics and Heuristics Real-time Protection Behavior Monitoring Dynamic Signature Service Malware Response Network Vulnerability Shielding

30. Convergence of Management and Security Built on System Center Configuration Manager 2012 Advanced protection with lower impact on productivity New Enhancements Simplified hierarchy model Role Based Access Control Definition Updates and automatic approval rules through ConfigMgr Improved alert timings Evaluation Options FEP 2012 Beta available now: http://www.microsoft.com/fep Join Community Evaluation Program (included in ConfigMgr CEP) https://connect.microsoft.com/site1211

32. www.microsoft.com/teched Sessions On-Demand & CommunityMicrosoft Certification & Training Resources Resources for IT ProfessionalsResources for Developers www.microsoft.com/learning http://microsoft.com/technet http://microsoft.com/msdn http://northamerica.msteched.com Connect. Share. Discuss.

34. Scan the Tag to evaluate this session now on myTechEd Mobile