Explore a groundbreaking 35-minute Black Hat conference talk on Rope, a novel covert distributed execution technique for malware. Delve into how distributed malware concepts challenge behavioral detection by AV and EDR solutions by dispersing malicious execution across multiple processes. Examine the evolution from modular malware designs to more advanced approaches that split individual components into chunks. Discover the limitations of existing methods, including their reliance on detectable features and potential conflicts with OS hardening measures. Learn about Rope's innovative approach to bypassing behavioral detection through distributed ROP-driven execution. Gain insights from security researchers Daniele Cono D'Elia and Lorenzo Invidia as they present this cutting-edge technique for evading modern security systems.
Rope - Bypassing Behavioral Detection of Malware with Distributed ROP-Driven Execution
Overview
Syllabus
Rope: Bypassing Behavioral Detection of Malware with Distributed ROP-Driven Execution
Taught by
Black Hat
Related Courses
-
Bypassing Malware Detection Mechanisms in Online Banking
-
Full System Emulation - Achieving Successful Automated Dynamic Analysis of Evasive Malware
-
AVPASS - Leaking and Bypassing Antivirus Detection Model Automatically
-
Malware Morphology for Detection Engineers
-
Certificate Bypass - Hiding and Executing Malware from a Digitally Signed Executable
-
AVLeak - Fingerprinting Antivirus Emulators for Advanced Malware Evasion
