An In-memory Embedding of CPython for Offensive Use
This work addresses the need for security researchers and enterprise Red Teams to develop stealthy malware that evades detection by modern security products, though it is incremental as it builds on existing CPython embedding techniques.
The authors tackled the problem of malware detection by developing an in-memory embedding of CPython that loads Python scripts directly from memory without disk access, making it harder for security products to detect. This approach has been used in production for over a year to help security researchers and Red Teams rapidly prototype and deploy offensive techniques.
We offer an embedding of CPython that runs entirely in memory without "touching" the disk. This in-memory embedding can load Python scripts directly from memory instead these scripts having to be loaded from files on disk. Malware that resides only in memory is harder to detect or mitigate against. We intend for our work to be used by security researchers to rapidly develop and deploy offensive techniques that is difficult for security products to analyze given these instructions are in bytecode and only translated to machine-code by the interpreter immediately prior to execution. Our work helps security researchers and enterprise Red Teams who play offense. Red Teams want to rapidly prototype malware for their periodic campaigns and do not want their malware to be detected by the Incident Response (IR) teams prior to accomplishing objectives. Red Teams also have difficulty running malware in production from files on disk as modern enterprise security products emulate, inspect, or quarantine such executables given these files have no reputation. Our work also helps enterprise Hunt and IR teams by making them aware of the viability of this type of attack. Our approach has been in use in production for over a year and meets our customers' needs to quickly emulate threat-actors' tasks, techniques, and procedures (TTPs).