Sleep Obfuscation: How Beacons Vanish in Memory and Where the Artifacts Survive
AuthorAdrián DíazRead time14 minPublishedApr 23, 2026TopicsWindows InternalsEDR Evasion Table of Contents The previous post covered call stack spoofing: how an implant makes its call stack look legitimate at the moment an EDR inspects it. But that solves only half the problem. A memory scanner does not wait for the implant to call an API. It […]
Call Stack Spoofing: How Spoofers Beat the Unwinder and Where the Truth Still Lives
How three generations of call stack spoofers defeat the x64 unwinder, and where the detection still holds.
Parent PID and Command Line Spoofing: What the Kernel Still Knows
Both techniques make a process lie about itself, and both are on nearly every engagement. But they fail differently under scrutiny: one leaves a clean mechanical tell the spoof cannot erase, the other leaves nothing to compare against. Where the truth actually lives.
In-Memory .NET: Where the CLR’s Telemetry Actually Lives
Patch ETW and the CLR goes dark, load from a byte array and you dodge AMSI, Sysmon catches the DLL load anyway. Two of those are wrong on modern .NET and the third is structurally impossible. Where the telemetry for in-memory .NET really is, and which signals survive an operator inside the process.
The ETW Blind Spot: Red Team Tactics for Blinding Windows Event Tracing
ETW is the eyes of your EDR. What happens when an attacker covers them? We dissect the specific Red Team techniques used to blind Windows Event Tracing, including session hijacking and EtwEventWrite patching, and show Blue Teams how to spot the silence.
Virtualization as a Weapon: Detecting Portable QEMU and Red Team VMs
Virtualization is not just infrastructure; it is a weapon. Red Teams leverage portable QEMU instances to bypass host-based EDRs and evade behavioral analysis. We analyze how attackers deploy these “invisible machines” without administrative privileges and provide the KQL hunting queries defenders need to detect unauthorized virtualization on their networks.
Detecting Driver Loading: sc.exe vs. devcon.exe
Loading kernel drivers is a “Holy Grail” operation for attackers, granting Ring 0 privileges for persistence or EDR blinding. We analyze the forensic difference between the loud method (sc.exe) and the stealthy method (devcon.exe) to help Blue Teams build resilient detections.