Formatting for Justice: Crime Doesn’t Pay, Neither Does Rich Text

Due to it’s flexibility and capacity for embedding other objects, the rich text format (RTF) is a preferred file type used by both precision and quantity focused threat actors. This presentation will discuss the state of threats making use of the file format and provide a brief overview of how the file format is constructed. The presentation will also explain results of exploratory experiments conducted to achieve a deep comprehension of the file format’s structure. Best practices for building protections in organizations will be discussed. Techniques developed while hunting for specific features across large sample sets will be shared.


Anthony Kasza is a Senior Threat Researcher for Palo Alto Networks. At Palo Alto Networks, Anthony is responsible for discovering new and tracking known threats to ensure context around customer detections. Prior to Palo Alto Networks, Anthony was responsible for creating scalable classification systems, producing and operationalizing threat intelligence, and researching malware communication protocols. Anthony earned his Master of Science degree from DePaul University in Computer, Information, and Network Security. Anthony often speaks at industry conferences and actively participates in open source communities.

Print Friendly, PDF & Email
Anthony Kasza

@anthonykasza

Have keyboard, will SSH.
Fake news used to be called yellow journalism - 23 hours ago