No announcement yet.

Memhunter - Automated hunting of memory resident malware at scale

  • Filter
  • Time
  • Show
Clear All
new posts

  • Memhunter - Automated hunting of memory resident malware at scale

    Saturday from 10:00 – 11:50 in Sunset 6 at Planet Hollywood
    Audience: Defense Marcos Oviedo

    Memhunter is an endpoint sensor tool specialized in detecting memory-resident malware. The detection process is performed through a combination of endpoint data collection and memory inspection scanners. The tool is a standalone binary that, upon execution, deploys itself as a windows service. Once running as a service, memhunter starts the collection of ETW events that might indicate code injection attacks. The live stream of collected data events is feed into memory inspection scanners that use detection heuristics to down select the potential attacks. The entire detection process does not require human intervention, neither memory dumps, and it can be performed by the tool itself, at scale, improving the threat hunting analysis process and remediation times. The tool was designed as a replacement of memory forensic mechanisms such as volatility malfind and hollowfind plugins, which requires human analysis and memory dumps to find suspicious artifacts on memory. Besides the data collection and hunting heuristics, the project has also led to the creation of a companion tool called minjector that contains +20 code injection techniques. The minjector tool can be used to exercise memhunter detections, and as a one-stop learning solution on well-known code injection techniques out there.

    Marcos Oviedo
    Marcos Oviedo is an experienced, self-motivated, and results-driven software architect who loves to develop software not only to create code but to create value. He has had extensive experience with heterogeneous technologies and computer architectures. Over his years of professional work experience, computer security has long been his passion—whether it has been around designing exploit prevention capabilities of an endpoint security solution, or doing vulnerability research on carrier-grade telco charging software, or just participating on CTFs for fun. Marcos is currently working as an Endpoint Software Architect at McAfee. Marcos also organized the first-ever BSides conference in Cordoba, Argentina.