Use of Offensive Enclaves in Adversarial Operations
Dimitry Snezhkov explores executing offensive tradecraft inside Intel SGX secure enclaves, hiding malware payloads and decryption keys from host EDR sensors.
Summary
Hardware-Enforced Memory Encryption in Modern CPUs
Hardware secure enclaves (such as Intel SGX) provide encrypted memory regions (Enclave Page Cache) designed to protect confidential application data from untrusted host operating systems.
Repurposing Secure Enclaves for Offensive Persistence
Dimitry Snezhkov investigates running offensive tooling inside SGX enclaves, shielding malicious code and C2 communications from host hypervisors and EDR memory scanners.
Executing Covert In-Enclave Cryptographic Payloads
Because host monitoring tools cannot inspect encrypted enclave memory, ransomware and implant modules execute stealthily with zero host telemetry leakage.
Defending Host Platforms Against Rogue Enclaves
The author outlines hardware attestation requirements, kernel driver restrictions, and host auditing policies to prevent unverified enclave execution.
Related talks
Main Stage·16 min
Valerio Alessandroni
Valerio Alessandroni demonstrates how remote access trojans abuse trusted Google Cloud services and APIs for stealthy C2 communication and proxy tunneling.
Main Stage·47 min
Alessandro Magnosi
Malware deployment tactic exploiting NTFS features and emulated read-only filesystems to bypass endpoint inspection.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.