Proactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware

Main Stage·47 min

• DEF CON
• Malware
• Date: Aug 2023
• Location: Las Vegas

Patrick Wardle

Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.

Main Stage·40 min

• DEF CON
• Malware
• Date: Aug 2023
• Location: Las Vegas

Alessandro Magnosi · Arash Parsa · Athanasios Tserpelis

Introduces Full Moon and Half Moon call stack spoofing techniques to evade EDR inspection, alongside the Eclipse kernel detection algorithm.

Main Stage·39 min

• DEF CON
• Malware
• Date: Aug 2021
• Location: Las Vegas

Rex Guo · Junyuan Zeng

Rex Guo and Junyuan Zeng present the Phantom Attack, exploiting implementation flaws in Linux system call tracing frameworks to completely blind endpoint monitoring agents.