Tales of AV/EDR Bypass: Ropping the Night Away

No ratings

Presented at GrrCON Cyber Security Summit and Hacker Conference 2023 by

Gregory Hatcher

John Stigerwalt

Over the last couple of year, the evolution of calling Windows APIs in loaders has moved from direct system calls to indirect system calls. However, using indirect system calls will only get a malware developer so far; only the return address is modified, not the entire stack. Windows Event Tracing (ETW) can detect this malicious behavior. However, if we use ROP (return-oriented programming), we can gain control of the call stack. There will be no hard-coded syscalls or jumping to the syscall region. Using various ROP gadgets that create ROP chains, we can make our Windows APIs call stack look completely legitimate and undetectable to modern EDR products. When our functions return, they don’t return back to their own thread when complete. It is not possible to trace the call back to our RX region at all.