Loading story…
Elastic detailed enhanced Windows user-mode call-stack telemetry in Elastic Defend that attributes dual-use behavior to the code that initiated it. The telemetry enriches stack addresses with module exports and identifies the final user module’s path, SHA-256 hash, signature state, memory protections, and provenance, helping analysts identify direct syscalls, proxy execution, shellcode, ROP-like activity, unbacked RWX memory, and truncated or manipulated stacks. Dispatcher functions in captured stacks can also reveal early-thread execution, exception-handler abuse, APC-based execution, and GUI-thread hijacking.
The approach addresses a longstanding control-flow defense problem: ordinary stack walking reconstructs return addresses but can be misled by tail calls, trampolines, and stack manipulation. Earlier hardware-assisted CFI research, including Endgame’s HA-CFI, used Intel PMU branch-misprediction traps and Last Branch Record data to validate indirect-call targets and reported detection of ROP and ROPless exploit techniques across tested exploit samples. Elastic’s telemetry-focused implementation makes suspicious control-flow context available in endpoint alerts by default; organizations can also enable it for routine events, balancing additional visibility against increased telemetry volume.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic described Elastic Defend's use of enriched user-mode Windows call stacks to identify the originating module behind dual-use and malicious behavior. The telemetry flags patterns such as direct syscalls, proxied calls, shellcode, ROP-like execution, writable executable memory, and stack-reconstruction discrepancies.
Endgame researchers Cody Pierce, Matthew Spisak, and Kenneth Fitch presented HA-CFI, a hardware-assisted control-flow-integrity system using Intel PMU events and Last Branch Record data to detect and prevent control-flow hijacking on Windows and Linux. They reported testing against Metasploit modules and exploit-kit samples, including exploits for CVE-2015-2419 and CVE-2014-0515.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WithSecure documented how Windows AV and EDR drivers collect inline telemetry through kernel callbacks for process, thread, and object-access activity, including user-mode call stacks. Sysmon, for example, uses an object-handle callback and `RtlWalkFrameChain` to populate the `CallTrace` field in Event ID 10 process-access records; such traces can expose direct system calls by showing execution paths that omit `ntdll` before the kernel service transition. The research showed that x64 unwind metadata and frame reconstruction determine what collectors record, raising the prospect that an attacker could forge a plausible stack to mislead callback-based detections. Windows Security Event ID 4688 remains a separate audit source for newly created processes. Elastic Security Labs reported that kernel-originated ETW is generally more resistant to user-mode tampering than telemetry produced by user-mode clients or services, but warned that trusted event origin does not ensure complete or accurate data. Its analysis found that many kernel ETW events—particularly opaque or legacy providers—require manifests, symbols, binary analysis, or reverse engineering to interpret, and that some events record only failures. Organizations should correlate process-creation auditing, Sysmon call traces, and kernel ETW rather than rely on any one source, and validate whether their detections account for missing, manipulated, or semantically limited stack and ETW data.
Aug 26, 2026
Elastic added behavioral Windows keylogger detection to **Elastic Defend 8.12**, using Event Tracing for Windows (ETW) to observe API activity associated with keystroke collection through polling, keyboard hooks, Raw Input, and DirectInput. Prebuilt endpoint rules identify suspicious use of APIs including `GetAsyncKeyState`, `SetWindowsHookEx`, and `RegisterRawInputDevices`. In testing on Windows 10, Elastic Defend detected a proof-of-concept Raw Input keylogger soon after it executed, flagging an untrusted process that registered for keyboard input. The telemetry captures API arguments, call-stack context, process-signature status, and related process metadata, enabling defenders to investigate credential- and information-theft activity while reducing false positives from legitimate accessibility and input software.
Aug 27, 2026
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026