As cited
Copy frozen at (site build).
threat intel
Hunting For In-Memory .NET Attacks
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Hunting For In-Memory .NET Attacks
Adversaries increasingly use in-memory .NET techniques to evade detection, exploiting the Assembly.Load function to load malicious code into memory without touching disk and bypassing security controls like application whitelisting. The .NET framework's ubiquity on Windows, complex PE metadata format, and limited vendor coverage make it an attractive attack vector for groups like Deep Panda and OilRig. Defenders can employ both on-demand detection methods (such as hunting for suspicious memory characteristics and PowerShell module loading patterns) and real-time eventing-based approaches (such as hooking the CLR's LoadImage function) to identify and block these attacks.
Why it matters: Security teams using Windows endpoints need detection logic to identify .NET-based in-memory attacks, as most endpoint security products have poor visibility into managed .NET structures and these techniques can bypass traditional application whitelisting and antivirus controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Hunting For In-Memory .NET Attacks
Adversaries increasingly use in-memory .NET techniques to evade detection, exploiting the Assembly.Load function to load malicious code into memory without touching disk and bypassing security controls like application whitelisting. The .NET framework's ubiquity on Windows, complex PE metadata format, and limited vendor coverage make it an attractive attack vector for groups like Deep Panda and OilRig. Defenders can employ both on-demand detection methods (such as hunting for suspicious memory characteristics and PowerShell module loading patterns) and real-time eventing-based approaches (such as hooking the CLR's LoadImage function) to identify and block these attacks.
Why it matters: Security teams using Windows endpoints need detection logic to identify .NET-based in-memory attacks, as most endpoint security products have poor visibility into managed .NET structures and these techniques can bypass traditional application whitelisting and antivirus controls.
- Source published
- First seen by Cybersecurity Tracker