BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Evil Is Always a Bad Stylist: .NET Obfuscation with 
 Roslyn\n   Tags: Red Team Village | Misc\n   When: Sunday\, Aug 9\, 10:00 
 - 11:59 PDT\n   Where: LVCCW Level 1 Hall 1 309 (Red Team Village) Tactic 
 Table 4 -\n   [1]Map\n\n   Description:\n\n   Modern endpoint defenses inc
 reasingly fingerprint .NET tools not only\n   by strings and imports\, but
  by structure: control flow\, call graphs\,\n   and overall execution “w
 orkflows.” Traditional IL obfuscation can\n   hide obvious indicators\, 
 yet often produces highly regular flattened\n   patterns that are easy to 
 flag on their own.\n\n   This talk presents a Roslyn-based\, source-to-sou
 rce obfuscator for C#\n   that rewrites an entire project before compilati
 on. Using the official\n   compiler APIs\, it transforms the code’s synt
 ax and semantic\n   structure\, reshapes control/data flow\, and then reco
 mpiles the result\n   - while keeping the program’s observable behavior 
 intact. The output\n   tends to look complex but “natural\,” diverging
  both from the\n   original tool and from the telltale patterns created by
  many IL-level\n   obfuscators.\n\n   I will walk through the pipeline\, s
 how how surprisingly little code is\n   needed to build these transformati
 ons on Roslyn\, and discuss what this\n   means for EDR\, sandboxing\, and
  ML detections that rely on graph and\n   workflow analysis of .NET binari
 es.\n\n   So\, anyway\, on moment of submitting original Seatbelt tool (ob
 fuscated\n   by source) have 10/73 security vendors flagged this file as m
 alicious\n   (can be better)\n   https://www.virustotal.com/gui/file/ec2dc
 ecb927874d41b051633135c8a594abb40d03f6836a548b40963bf330c86/detection/f-ec
 2dcecb927874d41b051633135c8a594abb40d03f6836a548b40963bf330c86-1764839678\
 n\n   My project https://github.com/gam4er/Loaders differs from more well\
 n   known https://github.com/sadreck/Codecepticon by implementing semantic
 \n   structure obfuscation.\n\n   My point of view (sa a SOC analyst\, blu
 e teamer) on "how to hide\n   mytool from AV" problem is: if you have a co
 de - OBFUSCATE YOUR CODE.\n   Stop modifying binaries\n\n   Speakers:Alexa
 nder Rodchenko\,Ashley Hiram Muñoz\,Eduardo Chavarro\n   Ovalle\n\n   Spe
 akerBio:  Alexander Rodchenko\n\n   Rodchenko Alexander is a Senior SOC An
 alyst at the SOC Security\n   Research Group at Kaspersky. He began his ca
 reer at OJSC Rosneft\,\n   focusing on industrial safety\, troubleshooting
 \, and audits. Currently\,\n   he investigates industry events and trends 
 with the primary goal of\n   integrating these insights into monitoring an
 d threat hunting\n   practices. Leveraging his extensive expertise\, Alexa
 nder advises\n   customers and threat detection/hunting teams on the optim
 al response\n   to emerging threats and trends. In addition to speaking at
  Positive\n   Hack Days (twice) and BSides Zurich 2023\, he has also been 
 a speaker\n   at CodeBlue 2024 and BlackHat MEA 2024.\n\n   SpeakerBio:  A
 shley Hiram Muñoz\, Kaspersky - Incident Response\n   Specialist\n\n   I 
 currently work as an Incident Response Specialist on Kaspersky's\n   Globa
 l Emergency Response Team (GERT). I live in Mexico and have over\n   seven
  years of experience in Incident Response\, Digital Forensics\,\n   Malwar
 e Analysis\, and Reverse Engineering. Before joining DFIR\, I\n   worked f
 or two years as a Penetration Tester.\n\n   I have collaborated on various
  Threat Hunting and Threat Intelligence\n   projects.\n\n   Additionally\,
  I have been a speaker at international events such as\n   DEFCON (La Vill
 a Hacker)\, BSides\, Ekoparty\, 8.8\, HackGDL\, BugCON\,\n   Pwnterrey\, a
 nd others. I currently teach the Digital Forensics\,\n   Malware Analysis\
 , and Incident Response modules in an information\n   security diploma pro
 gram at UNAM (Universidad Nacional Autónoma de\n   México).\n\n   Certif
 ications: GREM\, GCFA\, GCFR\, eCTHP\, CHFI.\n\n   --\n\n   Actualmente me
  desempeño como Incident Response Specialist en el\n   Global Emergency R
 esponse Team (GERT) de Kaspersky\, cuento con +6\n   años de experiencia 
 realizando Respuesta a Incidentes\, Análisis\n   Forense Digital\, Análi
 sis de Malware y Reversing\; previo a dedicarme\n   a DFIR laboré 2 años
  como Penetration Tester.\n\n   He colaborado en distintos proyectos de Th
 reat Hunting y Threat\n   Intelligence.\n\n   Adicionalmente\, he sido pon
 ente en eventos internacionales como DEFCON\n   (La Villa Hacker)\, BSides
 \, Ekoparty\, 8.8\, BugCON\, etc.\n\n   Actualmente soy profesor de los m�
 �dulos de Análisis Forense\,\n   Análisis de Malware y Respuesta a Incid
 entes en un diplomado de\n   seguridad de la información de la UNAM.\n\n 
   Certificaciones: GREM\, GCFA\, eCTHP\, CHFI.\n\n   SpeakerBio:  Eduardo 
 Chavarro Ovalle\, DFIR Group Manager at Kaspersky\n   - GERT\n\n   Eduardo
  Chavarro Ovalle\, DFIR Group Manager for Americas\, member of\n   Kaspers
 ky GERT Team. Student of DBA in ML and AI and MSc in\n   Cybersecurity wit
 h more than 20 years of experience in cybersecurity\,\n   DFIR\, eDiscover
 y\, and threat analysis. GCIH | GRID | GCFA | CISM |\n   CHFI | CPTE | SFC
 P | ITIL.\n\n   '\n\n   1. #LVCCW_Level1_Hall1\n\n\n
DTEND:20260809T185900Z
DTSTART:20260809T170000Z
LOCATION:Red Team Village - LVCCW Level 1 Hall 1 309 (Red Team Village) Tac
 tic Table 4
SUMMARY:Evil Is Always a Bad Stylist: .NET Obfuscation with Roslyn
END:VEVENT
END:VCALENDAR