Avoiding Memory Scanners: Customizing Malware to Evade YARA & PE-sieve
Kyle Avery presents techniques for evading in-memory scanners (PE-sieve, Moneta, YARA), demonstrating advanced sleep obfuscation and heap encryption.
Summary
The Rise of In-Memory Threat Hunting
Modern defensive tooling (PE-sieve, Moneta, memory YARA rules) inspects process memory at runtime to detect unbacked executable pages, hooked functions, and injected beacons.
Deconstructing In-Memory Artifacts and Detections
Kyle Avery analyzes what makes injected payloads detectable—including RWX memory page permissions, modified thread call stacks, and unencrypted in-memory strings.
Implementing Advanced Sleep Obfuscation and Memory Masking
Avery demonstrates implementing sleep masking techniques (Ekko, Foliage) that dynamically encrypt memory pages, strip executable permissions, and spoof call stacks during sleep cycles.
Evolving Blue Team Memory Forensics
The author provides incident responders with methodologies for catching sleep-obfuscated payloads via timer queue inspection and thread pool analysis.
Related talks
Main Stage·39 min
Helvio Carvalho Junior
HookChain technique for dynamically altering API call sequences and hooking mechanics to bypass EDR telemetry in memory.
Main Stage·32 min
Michael Bargury
Michael Bargury weaponizes Windows 11's built-in Power Automate for desktop, creating zero-binary, signatureless 'no-code malware' that bypasses EDR controls.
Main Stage·27 min
Asaf Gilboa · Ron Ben-Yitzhak
Asaf Gilboa and Ron Ben-Yitzhak present a stealthy credential dumping technique that abuses native Windows Error Reporting (WER) to dump LSASS without alerts.