CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining

mrtiz.github.io

cross-posted to:
netsec

CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining

mrtiz.github.io

digicat@infosec.pubM to

blueteamsec@infosec.pubEnglish · 2 months ago

cross-posted to:
netsec

A CET-compliant callstack spoofing technique that uses Windows thread-pool enum callbacks as syscall trampolines, defeating EDR stack telemetry without breaking Intel shadow-stack invariants.

You must log in or register to comment.

Chat

blueteamsec@infosec.pub

Create a post

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !blueteamsec@infosec.pub

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

12 users / day
59 users / week
294 users / month
1.01K users / 6 months
1 local subscriber
798 subscribers
3.19K Posts
227 Comments
Modlog

mods:
digicat@infosec.pub