APTs Way: Evading Your EBNIDS
summary
Shows concrete evasion techniques that reliably bypass two emulation‑based NIDS prototypes used for evaluation: emulation escapes via context keying (decoder key derived from target-only values), long-running and random decryption algorithm time stalling to outrun emulator thresholds, fragmented payloads and API‑based egg hunting that avoid preprocessor heuristics, and use of unsupported SIMD/FPU ops plus CPUID/timing checks to detect emulation. Demos against the tested emulators show simple polymorphic shells are caught but multiple designed evasions go undetected.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:04Evolution of shellcode
- 2:15Emulation-based detection
- 4:26Heuristics and detection
- 8:07Advanced detection methods
- 11:26Categories of evasion
- 16:12Preliminary results and demo
- 18:51Evasion demonstration
- 22:04Evasion implementation details
- 30:46Extended evasion techniques
- 32:48Detecting emulation
- 35:52Anti-disassembly
- 36:57Unsupported instructions
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
52mFlying Under the Radar - New Security Evasion Techniques
55mHiding PIN's Artifacts to Defeat Evasive Malware
40mISE-Skating: Lessons Learned in Bypassing Network Access Control
45m"Advanced Malware Threat: handling obfuscated code using..."
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware