Stanislav Stan Ruzin

WORK HISTORY

EDUCATION

SKILLS

ABOUT STANISLAV STAN RUZIN

Stanislav (Stan) Ruzin is a C, C++, x86_64 developer - with 12 years of professional experience - specializing in the cybersecurity (information security) field. Stan has worked on solutions for Endpoint Detection and Response (XDR, EDR, Anti-Virus), Lottery transactions and security validation, Windows Active Firewall (packet filters), and security report automation. During his tenure at GoSecure, Stan fixed issues and added features to the legacy EDR solution (Anti-Virus). Stan\'s major contribution at GoSecure was to modernize the legacy Win32 driver\'s (written in clean C, using WDM Win32) platform communication subsystem, requiring careful implementation of winsocks running in the Windows kernel as a minifilter. Further, he contributed to developing classes which allow the user-mode service to communicate with the driver via IOCTL.Also at GoSecure, Stan was assigned to patch the EDR blindspots, as outlined by MITRE audits. Key points were the detection of WMI reconnaissance, and the detection of malware which was native compiled, but manually initialized the CLR /.NET runtime, and later decrypted a payload, and executed it as malicious.NET bytecode.Stan resolved both issues and wrote POCs and integrated them with the EDR agent. This was accomplished through the rigorous reverse engineering of the CLR and WMI frameworks, which resulted in several hooks being installed in the those framework libraries. The EDR DLL would hook the vftable of methods that were related to initialization of core CLR objects, and the vftable patching of methods related to performing WMI queries. The EDR hook library would intercept the vftable, reroute it to the EDR, and generate an event, thus revealing encrypted.NET malware, disguised as a non.NET exe, and any form of WMI queries (worked for powershell.NET, and COM).Stan has also worked closely with McAfee ESM (SIEM) for Jolera Inc. Stan created network architecture maps for the deployment of SIEM collectors on the customer side, which would aggregate events on the customer\'s network. Stan designed a reporting application in golang that interfaced with the ESM using their RESTful API, and generated a \"security risk ranking\" for executives and MSP customers, as a part of Jolera\'s SIEM solution.Before switching to software engineering, Stan\'s roles included reverse engineering malware at Telus. Each malware sample was accompanied by a report, which included the malware behaviour (retrieved by reversing), Snort (regex) sigs which were deduced by examining the malware\'s c2c communication code, and various IOCs.