Security Engineer Discusses Infostealer Malware and Defense Strategies at Black Hat

The video features Olivia Gloochie, a security engineer at Datadog, discussing infostealer malware and defense strategies at Black Hat. Infostealers operate in four stages: initial access (via malicious downloads or phishing), execution (injecting into background processes to evade antivirus), data harvesting (scraping browser profiles, passwords, and session cookies), and exfiltration (sending stolen data to attackers within seconds). Defense mechanisms include behavioral EDR and detection engineering to identify malware behavior, custom detector rules to flag suspicious patterns in logs, and device trust systems to detect anomalous session activity (e.g., a US-based cookie appearing in France). Hardware-based MFA, such as FIDO2 YubiKeys, is recommended to prevent credential harvesting. Networking at Black Hat is highlighted as a resource for troubleshooting EDR challenges and evaluating security products. The discussion emphasizes breaking the attack chain at multiple points to mitigate threats.