CALL STACKS: NO MORE FREE PASSES FOR MALWARE

Summary from the TLDR InfoSec newsletter

Elastic's Windows endpoint telemetry analyzes call stacks to identify both the activity and the performer, enhancing malware detection. The call stacks, or "return address stacks," can be manipulated by malware using return address spoofing and stack frame crafting to conceal malicious actions. Elastic enriches these stacks with module information, applies behavioral tagging, and detects sophisticated evasion tactics like SilentMoonwalk call stack spoofing.