Chapter 5 · Attacks & Defenses·Intermediate·~16 min

Malware

Persistence ASEPs, process injection techniques, C2 channels including DGA, and how EDR actually catches them.

You will learn

  • The standard persistence locations across Windows and Linux
  • Process injection methods (DLL injection, hollowing, reflective loading, APC injection)
  • C2 channel design including DNS tunneling and DGAs
  • How EDR hooks the OS and what defenders see

Persistence mechanisms

Malware that does not survive a reboot is rarely worth writing. ASEPs (Auto-Start Extensibility Points) are the locations the OS reads at boot or login. MITRE ATT&CK T1547 documents over 30. The common ones:

  • Windows Registry Run keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM variant. Easy to write, easy for AV to spot.
  • Scheduled Tasks: per-user or system-wide. Slightly stealthier than Run keys.
  • Services: HKLM\System\CurrentControlSet\Services. Runs at boot, often as SYSTEM.
  • WMI Event Subscriptions: stealthier. Triggered by system events, no obvious file on disk.
  • Linux systemd units, cron, .bashrc, /etc/profile.d, LD_PRELOAD in /etc/ld.so.preload.
  • Bootkit / UEFI: the most persistent and the most expensive to develop. Survives OS reinstalls.

Defender's perspective: monitor changes to these locations. Sysmon on Windows and auditd on Linux catch most of them.

Process injection

Running code under the identity of a different, trusted process. Techniques:

  • DLL injection: OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread with LoadLibrary as the start address. Loud; hooked by every EDR.
  • Process hollowing: spawn a benign process suspended, unmap its image, write the malicious image, resume. Now svchost.exe is the malware.
  • Reflective DLL loading: malware loads a DLL into the current process by parsing the PE format itself, never calling LoadLibrary. Bypasses static disk indicators.
  • APC injection: queue an Asynchronous Procedure Call on a target thread. Runs the next time the thread enters alertable wait.
  • Process Doppelganging / Herpaderping: NTFS transaction tricks to load a malicious image while disk shows benign content.

EDR products hook these specific API patterns. The cat-and-mouse moved to syscall-direct techniques that bypass userland hooks (Hell's Gate, Halos Gate), which then drive kernel callbacks and ETW-Threat-Intelligence.

C2 channels

Once a foothold persists, it needs to phone home. C2 (Command and Control) channels:

  • HTTP / HTTPS beacons. Most common. Blend with normal traffic. Defenders look for unusual timing (perfectly periodic), unusual JA3/JA4 TLS fingerprints, or destinations with poor reputation.
  • DNS tunneling: encode data in subdomain labels, exfiltrate via lookups to attacker-controlled authoritative servers. Slow but often unfiltered.
  • DGA (Domain Generation Algorithm): malware generates many candidate domains per day using a seeded PRNG. Attacker registers one in advance. Defenders cannot block them in advance; have to detect the algorithm.
  • Domain fronting: HTTPS request to a CDN with an SNI for an allowed site but Host header for the attacker's hidden origin. Largely shut down by major CDNs but variants persist.
  • P2P / blockchain: BitTorrent overlays, blockchain transactions carrying instructions. Resilient to takedown.

EDR mechanics

Endpoint Detection and Response collects telemetry from the host and feeds it to a central engine. Sources:

  • User-mode hooks: inject a DLL into every process, hook common Win32 APIs (CreateProcess, VirtualAlloc, WriteProcessMemory). Bypassable from syscall-direct code.
  • Kernel callbacks: PsSetCreateProcessNotifyRoutine, ObRegisterCallbacks for handle operations, mini-filter for filesystem. Harder to bypass without kernel rights.
  • ETW (Event Tracing for Windows): rich event stream. Threat Intelligence provider catches a lot of injection patterns.
  • AMSI: Anti-Malware Scan Interface. Scripting engines submit scripts before execution. Attackers spend significant effort on AMSI bypasses (memory patching).

Linux equivalents: eBPF tracing (now the platform of choice), audit subsystem, kernel modules. Falco, Tetragon, and most cloud EDRs use eBPF.

Take the quiz Back to beginner