MISBEHAVING MODALITIES: DETECTING TOOLS, NOT TECHNIQUES

Summary from the TLDR InfoSec newsletter

Execution Modality is a detection engineering technique that describes how a malicious behavior is executed rather than what the malicious behavior does. Detecting Execution Modality shifts detection closer to the operating system source of truth to create a technique-agnostic detection while preserving necessary context. Given this, Kernel Event Tracing for Windows (ETW) should be considered superior to user-mode ntdll hooking.