Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks

Αποστολόπουλος, Θεόδωρος; Katos, Vasilios; Choo, Kim‐Kwang Raymond; Patsakis, Constantinos

doi:10.1016/j.future.2020.11.004

Cited by 25 publications

(14 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Apart from finding 'blind spots' for each EDR, there is also the choice of 'blinding' them by tampering with their telemetry providers in various ways. Unhooking user-mode hooks and utilizing syscalls to evade detection is the tip of the iceberg [18]. The heart of most EDRs lies in the kernel itself as they utilize mini-filter drivers to control file system operations and callbacks in general to intercept activities, such as process creation and loading of modules.…”

Section: Tampering With Telemetry Providersmentioning

confidence: 99%

An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors

Karantzas

Patsakis

2021

JCP

Self Cite

View full text Add to dashboard Cite

Advanced persistent threats pose a significant challenge for blue teams as they apply various attacks over prolonged periods, impeding event correlation and their detection. In this work, we leverage various diverse attack scenarios to assess the efficacy of EDRs against detecting and preventing APTs. Our results indicate that there is still a lot of room for improvement as state-of-the-art EDRs fail to prevent and log the bulk of the attacks that are reported in this work. Additionally, we discuss methods to tamper with the telemetry providers of EDRs, allowing an adversary to perform a more stealth attack.

show abstract

Section: Tampering With Telemetry Providersmentioning

confidence: 99%

An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors

Karantzas

Patsakis

2021

JCP

Self Cite

View full text Add to dashboard Cite

show abstract

“…Apart from finding 'blind spots' for each EDR there is also the choice of 'blinding' them by tampering with their telemetry providers in various ways. Unhooking user-mode hooks and utilising syscalls to evade detection is the tip of the iceberg [2]. The heart of most EDRs lies in the kernel itself as they utilise mini-filter drivers to control file system operations and callbacks in general to intercept activities such as process creation and loading of modules.…”

Section: Tampering With Telemetry Providersmentioning

confidence: 99%

An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors

Karantzas,

Patsakis

2021

Preprint

Self Cite

View full text Add to dashboard Cite

Advanced persistent threats pose a significant challenge for blue teams as they apply various attacks over prolonged periods, impeding event correlation and their detection. In this work, we leverage various diverse attack scenarios to assess the efficacy of EDRs and other endpoint security solutions against detecting and preventing APTs. Our results indicate that there is still a lot of room for improvement as state of the art endpoint security systems fail to prevent and log the bulk of the attacks that are reported in this work. Additionally, we discuss methods to tamper with the telemetry providers of EDRs, allowing an adversary to perform a more stealth attack.

show abstract

“…cloud computing, some malware is even more targeted, trying to detect sandboxed environments and not simply virtualised [33]. For more on evasion methods the interested reader may refer to [6,15,26,30,31,1,5,2]. These countermeasures from the malware have resulted in the introduction of anti-evasion methods.…”

Section: Related Workmentioning

confidence: 99%

Python and Malware: Developing Stealth and Evasive Malware Without Obfuscation

Koutsokostas¹,

Patsakis²

2021

Preprint

Self Cite

View full text Add to dashboard Cite

With the continuous rise of malicious campaigns and the exploitation of new attack vectors, it is necessary to assess the efficacy of the defensive mechanisms used to detect them. To this end, the contribution of our work is twofold. First, it introduces a new method for obfuscating malicious code to bypass all static checks of multi-engine scanners, such as VirusTotal. Interestingly, our approach to generating the malicious executables is not based on introducing a new packer but on the augmentation of the capabilities of an existing and widely used tool for packaging Python, PyInstaller but can be used for all similar packaging tools. As we prove, the problem is deeper and inherent in almost all antivirus engines and not PyInstaller specific. Second, our work exposes significant issues of well-known sandboxes that allow malware to evade their checks. As a result, we show that stealth and evasive malware can be efficiently developed, bypassing with ease state of the art malware detection tools without raising any alert.

show abstract

Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks

Cited by 25 publications

References 25 publications

An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors

An Empirical Assessment of Endpoint Detection and Response Systems against Advanced Persistent Threats Attack Vectors

An Empirical Assessment of Endpoint Security Systems Against Advanced Persistent Threats Attack Vectors

Python and Malware: Developing Stealth and Evasive Malware Without Obfuscation

Contact Info

Product

Resources

About