Malicious Memory Techniques on Windows & How to Spot Them
Connor Morley analyzes Windows in-memory injection techniques—including process hollowing and thread hijacking—and how defenders detect them.
Summary
Connor Morley presents a comprehensive deep-dive into advanced in-memory offensive tradecraft on Windows and the corresponding forensic techniques defenders must use to detect memory manipulation.
[12:04] Morley analyzes how modern adversaries and red teams bypass standard endpoint detection and response (EDR) user-land API hooks. He reviews the mechanics of process injection, DLL unhooking, and direct system calls (Syswhispers, Hell's Gate, and Halo's Gate), explaining how attackers retrieve unhooked syscall numbers directly from ntdll.dll to avoid triggering EDR instrumentation callbacks.
[24:22] The talk delves into kernel-mode hook detection, I/O control (IOCTL) routing, and advanced evasion methods such as Heaven's Gate [37:06] (transitioning between 32-bit WoW64 emulation and 64-bit execution) and Vectored Exception Handling (VEH) manipulation [48:08]. Morley outlines forensic inspection workflows for blue team analysts, showing how to leverage memory analysis frameworks like Volatility, Moneta, and Pe-sieve to identify abnormal memory page protections (PAGE_EXECUTE_READWRITE), detect unbacked executable code, trace modified function preambles, and uncover hidden in-memory implants.
(AI summary — Gemini Flash)
Related talks
Main Stage·44 min
Andrew Case · Chad Sellers · Golden G. Richard III
Memory forensics techniques and Volatility 3 plugins designed to detect direct syscalls, module stomping, and EDR bypasses.
Blue Team Village·50 min
Project Obsidian
Project Obsidian details hunting for malicious scheduled tasks, cron jobs, and stealthy persistence mechanisms across enterprise endpoints.
Main Stage·26 min
Andrew King
Andrew King explores detecting reflective injection at DEF CON 20, examining reflective-dll-injection and practical defenses.