Chirag Savla is a Cyber Security professional with 9+ years of experience in penetration testing, red teaming, azure and active directory security, and post-exploitation research.
Over the last few years we have seen tremendous improvements in the EDR solutions, so have the malware authors evolved from direct system calls to indirect system calls with additional techniques such as module stomping etc. EDR vendors have started monitoring for Stack telemetry by leveraging Event Tracing for Windows (ETW). This can detect the usage of indirect system calls, since it modifies only the return address but not the entire stack. To bypass such detection there are multiple techniques that are already documented by many researchers globally such as Call Stack Spoofing, Thread Stack Spoofing and Proxy Loading.
In this talk we will reveal some new undocumented Windows API calls for Proxy Loading our functions by leveraging callback functions that will help us in bypassing detections. These techniques will help us in bypassing Stack Telemetry based detection, as it will contain a clean stack without following the trail like LoadLibrary returns to -> Callback Function returns to -> RX region. When our functions return, they don’t return back to their own thread when execution is completed. Thus it is not possible to trace the call back to our RX region.