StackMoonwalk: Advanced Call Stack Tampering and Detection
Introduces Full Moon and Half Moon call stack spoofing techniques to evade EDR inspection, alongside the Eclipse kernel detection algorithm.
Summary
The Cat-and-Mouse Game of Call Stack Inspection
Modern Endpoint Detection and Response (EDR) sensors analyze thread call stacks during sensitive API calls to identify injected shellcode and unbacked memory execution.
Full Moon and Half Moon Stack Tampering
Alessandro Magnosi, Arash Parsa, and Athanasios Tserpelis present two advanced call stack spoofing techniques that manipulate frame pointer chains to construct unwinding-compliant synthetic stacks.
Defeating Conventional Heuristic Stack Checks
By generating logically valid unwinding sequences, these techniques conceal malicious payload invocation while maintaining thread stability across asynchronous exceptions.
The Eclipse Detection Algorithm
To counter stack spoofing, the authors introduce Eclipse, a detection algorithm extending RtlVirtualUnwind to enforce strict instruction validation and detect tampered execution frames.
Related talks
Main Stage·47 min
Patrick Wardle
Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.
Main Stage·39 min
Rex Guo · Junyuan Zeng
Rex Guo and Junyuan Zeng present the Phantom Attack, exploiting implementation flaws in Linux system call tracing frameworks to completely blind endpoint monitoring agents.