BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: DFMI: Weaponizing MSI Installers for Fileless Code E
 xecution\n   Tags: DEF CON Demo Labs | Intermediate | Defense/Blue Team | 
 Malware |\n   Offense/Red Team | Purple Team | Threat Intel/Hunting | DEF 
 CON Demo\n   Labs\n   When: Saturday\, Aug 8\, 10:00 - 10:45 PDT\n   Where
 : LVCCW Level 1 Hall 3 900 (Demo Labs Track 4) - [1]Map\n\n   Description:
 \n\n   DFMI is a cross-platform\, open-source offensive toolkit that hijac
 ks &\n   abuses the Windows Installer's own execution engine to detonate\n
    arbitrary payloads during software installation\, with zero files\n   w
 ritten to disk and zero evidence left behind. And this can be\n   achieved
  without corrupting the Authenticode of the binary. --Which\n   means\, AN
 Y signed legitimate installer file can leveraged as an attack\n   vector.\
 n\n   Right now\, DFMI provides 3 different methods for abusing MSI files:
 \n\n     * Inject: Simply injects a CustomAction (CA) into an existing MSI
 \n       package.\n\n     * Rogue MST: Generates an MSI Transform File (.m
 st) and injects into\n       legitimate ".msi" file without corrupting it'
 s Authenticode. The\n       original MSI file is never modified — its Au
 thenticode signature\n       remains fully intact and valid. This means a 
 signed\, trusted MSI\n       can be weaponized without leaving any forensi
 c trace on the file\n       itself\; the transform rides alongside it at d
 eployment time.\n\n     * Stub: Creates a malicious MSI file from scratch.
 \n\n   GitHub: https://github.com/ccelikanil/DFMI\n\n   SpeakerBio:  Anil 
 Celik\n\n   Computer Engineer & been working as a Red Teamer for the past 
 ~7\n   years. Previously did presentations at DEFCON 33 Demo Labs\, DEFCON
  33\n   Red Team Village & Black Hat USA Arsenal 2025. Currently holding 6
 \n   CVEs\, OSCP & OSWP.\n\n   Interests: Windows Internals & AD Security\
 n\n   Links:\n       GitHub - [2]https://github.com/ccelikanil/DFMI\n   '\
 n\n   1. #LVCCW_Level1_Hall3\n   2. https://github.com/ccelikanil/DFMI\n\n
 \n
DTEND:20260808T174500Z
DTSTART:20260808T170000Z
LOCATION:Demo Labs - LVCCW Level 1 Hall 3 900 (Demo Labs Track 4)
SUMMARY:DFMI: Weaponizing MSI Installers for Fileless Code Execution
END:VEVENT
END:VCALENDAR