Hunting Fileless Malware with Treesitter
Explore cutting-edge techniques for detecting obfuscated, fileless malware using the tree-sitter parser generator library in this conference talk. Delve into research demonstrating how tree-sitter can be leveraged to create scalable, accurate, and attributable detections for malicious PowerShell and Bash payloads. Learn about the challenges posed by obfuscated malware to automated detection systems and manual analysis, and discover how tree-sitter's error recovery capabilities make it particularly effective for memory forensics scenarios. Gain insights into the limitations of existing dynamic and static analysis methods, and understand how tree-sitter's query language enables precise targeting of specific document characteristics. Examine the effectiveness of a small ruleset in identifying token and string-based obfuscation techniques without false positives, and explore techniques for detecting syntax tree characteristics of PE droppers.