edrEvasionWorkshop

edrEvasionWorkshop 工作坊材料，主题为“逐步恶意软件开发：从加载器到内核规避EDR”，已在 DEF CON 34和 BSidesLV 2026上展示。 本工作坊探讨自定义恶意软件开发、EDR架构与规避、C2定制以及内核级技术，以Elastic Defend 作为目标EDR。 逐步恶意软件开发：从加载器到内核规避EDR 来自DEF CON 34 和BSidesLV 2026 的工作坊材料。 材料涵盖的主题包括： EDR架构 APC注入 Fiber 模块踩踏（Module Stomping） 调用栈欺骗 间接系统调用 使用Havoc进行C2定制 内核级攻击...

Secured-core PCs: A brief showcase of chip-to-cloud security against kernel attacks

Gaining kernel privileges by taking advantage of legitimate but vulnerable kernel drivers has become an established tool of choice for advanced adversaries. Multiple malware attacks, including RobbinHood, Uroburos, Derusbi, GrayFish, and Sauron, and campaigns by the threat actor STRONTIUM, have...

TrueType Font Exploits Gateway to Kernel Attacks

Font-parsing vulnerabilities weren’t part of the security consciousness much until the discovery of Duqu at the end of 2011. The spy malware hooked into the Windows kernel through bugs in the TrueType font file parsing engine, and not only breathed new life into the concept of cyber espionage, bu...

Malware Using White Lists, Forgery, Kernel Attacks To Stay Alive

BARCELONA — Rootkit programs are increasingly mimicking anti virus programs: adopting self protection features and even application whitelists to maintain control over the systems they control, according to a presentation at the annual Virus Bulletin Conference. Rachit Mathur, a research scientis...