Ghost Math: Syscall-Only Injection, Deterministic Shellcode & QUIC C2 — A Full Kill-Chain that Slipped Past CrowdStrike Falcon.

No ratings

Presented at GrrCON 2025 by

Ananda Krishna

Can an attacker still remain invisible in a network blanketed by next-gen EDR? During a 2025 red-team assessment we proved it, chaining three ideas that rarely show up together: Thread-less, syscall-only injection. A signed-MSI sideload landed us in explorer.exe; a reflective loader rebuilt raw syscall stubs from a clean ntdll mapping, queued a user-mode APC into an existing thread, and flipped pages RW→RX with NtProtectVirtualMemory, evading the classic “handle + RW + thread + DLL” heuristic. “Mathematical” payload generation. Our reverse shell’s bytes were deterministically derived from trigonometric constants, removing static patterns and short-circuiting Falcon’s cloud-similarity scans. Bespoke QUIC/HTTP-3 C2. Domain-fronted, JA3-collision jitter, and time-boxed sessions produced TLS fingerprints indistinguishable from Chrome. We will walk through the loader tricks, AMSI/ETW micro-patches, WMI event-filter persistence, and token impersonation, then map every step to MITRE ATT&CK v14 (T1055.001, T1562.001, T1105, T1546.003). Finally, attendees receive Atomic-style emulation scripts plus Splunk/Sigma rules so defenders can replicate—and finally detect—math-driven obfuscation in their own labs.