You Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
summary
Describes three concrete detection techniques and three tools being released: monitoring ETW ProtectVM events to count virtualprotect toggles and alert on frequent non-executable→executable flips; a mutable code-page heuristic that tracks pages historically marked executable to catch oscillation despite VAD loss; and scanning the CFG safety bitmap to find pages that executed earlier but were later toggled non-executable. Demonstrations show reliable detection with tunable thresholds, some false positives (JIT reuse, freed pages) and practical mitigations and tradeoffs documented in the repo.
AI-written summary · about
chapters (11)
- 0:00Hidden shellcode detection intro
- 1:29Memory scanning in endpoint security
- 6:50Memory scanning techniques today
- 10:42Evasion: Gargoyle and variants
- 13:32Detecting Gargoyle memory fluctuation
- 17:03Immutable code page principle
- 20:13CFG bitmap for detection
- 25:12Defense in depth opportunities
- 27:19Hunting abnormal syscalls
- 29:48Syscall behavior at scale
- 30:31Summary and future
related talks
27mDetecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
45m"Advanced Malware Threat: handling obfuscated code using..."
28mFileless Attack - Detecting the Undetectable
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
37mDynamic Image Scanning Through System Tracing
30mThe Hidden ART Of Rolling Shellcode Decryption