The king is dead, long live the king! After the cloud detection technology becomes standard, the monitoring and control line of modern anti-virus products is as strong as the eye in the sky - not only can multi-level monitoring effectively locate potentially threatening program files, but also can overlook the flow of program files with God's perspective. In addition to multi-level monitoring to effectively locate potentially threatening files, we can also take a God's-eye view of the flow of program files and send back samples to researchers and analysis models to effectively stop the spread of malicious files to more victim devices in real time. Therefore, the main challenge for malware designers is to survive the Post Exploitation phase in this cat-and-mouse game.

Many familiar techniques have been developed in the wild, such as initiating project poisoning, hijacking COM projects, or using system-level Rookit to hide backdoors; however, no backdoor protection technique has been developed that can be completely protected from analysis even if "the entire program file is passed back to researchers.

Imagine a scenario where a malicious program is armored with "digital anti-copy protection", and once it is installed on the victim's machine, it is automatically corrupted and cannot be executed or analyzed once it is sent back to the security company.)

In this session, we will start with Process Doppelgänging techniques and variants, and explain a new Unlink attack technique that allows malicious programs to achieve fileless attacks, forge their own digital signatures, and even arm themselves so that they cannot be copied and analyzed by researchers.