{"id":2418,"date":"2019-01-26T11:01:47","date_gmt":"2019-01-26T10:01:47","guid":{"rendered":"https:\/\/werle.pro\/?p=2418"},"modified":"2019-01-26T11:12:25","modified_gmt":"2019-01-26T10:12:25","slug":"anssi-ssi-inc-coriin-2019-travaux-danalyse-de-lamcache","status":"publish","type":"post","link":"https:\/\/werle.pro\/index.php\/2019\/01\/26\/anssi-ssi-inc-coriin-2019-travaux-danalyse-de-lamcache\/","title":{"rendered":"ANSSI SSI-INC &#8211; CoRI&#038;IN 2019 travaux d&rsquo;analyse de l\u2019AmCache"},"content":{"rendered":"<p>\u00ab\u00a0<strong>AmCache<\/strong> : Artefact d\u2019ex\u00e9cution de binaires \u201cshim\u00e9s\u201d et d\u2019installation de programmes \u00e0 partir de Windows 7 et Server 2008 R2 ; Solutions techniques permettant d\u2019assurer la compatibilit\u00e9 des applications sur diff\u00e9rents syst\u00e8mes\u00a0\u00bb<\/p>\n<p>\u00ab\u00a0La faible notori\u00e9t\u00e9 de l\u2019AmCache en fait un artefact de choix lors de recherches de compromissions \u00e9volu\u00e9es, car il peut facilement \u00eatre oubli\u00e9 par un attaquant cherchant \u00e0 effacer ses traces. Bien que les donn\u00e9es collect\u00e9es dans cet artefact soient extr\u00eamement utiles, leur interpr\u00e9tation correcte est rendue complexe par de nombreux cas particuliers \u00e0 prendre en compte lors d\u2019une analyse.<\/p>\n<p>Les travaux pr\u00e9sent\u00e9s lors de la CoRI&amp;IN 2019 visent \u00e0 r\u00e9habiliter cet artefact aupr\u00e8s des analystes, en fournissant une documentation de r\u00e9f\u00e9rence d\u00e9taill\u00e9e des cas dans lesquels une conclusion peut \u00eatre tir\u00e9e.\u00a0\u00bb<\/p>\n<p><a href=\"https:\/\/www.ssi.gouv.fr\/agence\/publication\/analyse-de-lamcache\/\">www.ssi.gouv.fr\/agence\/publication\/analyse-de-lamcache\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u00ab\u00a0AmCache : Artefact d\u2019ex\u00e9cution de binaires \u201cshim\u00e9s\u201d et d\u2019installation de programmes \u00e0 partir de Windows 7 et Server 2008 R2 ; Solutions techniques permettant d\u2019assurer la compatibilit\u00e9 des applications sur diff\u00e9rents syst\u00e8mes\u00a0\u00bb \u00ab\u00a0La faible notori\u00e9t\u00e9 de l\u2019AmCache en fait un artefact de choix lors de recherches de compromissions \u00e9volu\u00e9es, car il peut facilement \u00eatre oubli\u00e9 &#8230; <a title=\"ANSSI SSI-INC &#8211; CoRI&#038;IN 2019 travaux d&rsquo;analyse de l\u2019AmCache\" class=\"read-more\" href=\"https:\/\/werle.pro\/index.php\/2019\/01\/26\/anssi-ssi-inc-coriin-2019-travaux-danalyse-de-lamcache\/\" aria-label=\"Read more about ANSSI SSI-INC &#8211; CoRI&#038;IN 2019 travaux d&rsquo;analyse de l\u2019AmCache\">Lire la suite<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7ALXt-D0","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/posts\/2418"}],"collection":[{"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/comments?post=2418"}],"version-history":[{"count":2,"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/posts\/2418\/revisions"}],"predecessor-version":[{"id":2420,"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/posts\/2418\/revisions\/2420"}],"wp:attachment":[{"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/media?parent=2418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/categories?post=2418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/werle.pro\/index.php\/wp-json\/wp\/v2\/tags?post=2418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}