Stealthy Code Execution: Exploiting Continue Handlers and Data Corruption to Evade Windows Defence
Year: 2024
Type: conference-paper
Abstract: In this presentation, we unveil novel code execution primitives and memory evasion techniques that bypass Windows security mitigations such as Control Flow Guard (CFG), eXtended Flow Guard (XFG), and mainstream antivirus (AV) and Endpoint Detection and Response (EDR) solutions. We introduce innovative methods leveraging Vectored Exception Handlers (VEH), Vectored Continue Handlers (VCH), hardware breakpoints, and page guards (PG) to execute arbitrary code while evading memory scanners and detection mechanisms. Additionally, we present a new data corruption attack that exploits writable virtual method table (VMT) pointers in the .data section of legitimate modules, enabling stealthy, threadless code execution in remote processes without generating classic indicators of compromise (IoCs) or using thread creation or memory protection alterations. Our research includes the development of a binary generator, a multi-layered evasion tool that integrates these techniques, demonstrating their effectiveness against prominent AV and EDR products. The new version of this tool will be released in due course. We discuss the implications of these findings on current defensive strategies and propose potential countermeasures to enhance system security.
Author: Meng, Thomas Xuan
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W6892968740
FWCI:
Cites:
Cited by:
Related to: