DOCSEARCHbyAlgolia
Submit Docs

Patriot Memory Detection Project

repository·main·Indexed 41 days ago

https://github.com/joe-desimone/patriot

A research project focused on detecting in-memory stealth techniques and memory-based malware anomalies. Version v0.3 includes detections for suspicious CONTEXT structures, MZ/PE header validation for process hollowing, unbacked executable regions, and module stomping or overwriting.

Tokens
278
Snippets
1
Records
2
Agent score
1%

What's inside Patriot

  1. Overview of Patriot detection capabilities

    main

    Patriot is a research project designed to detect various in-memory stealth techniques used by malware. The current version (v0.3) provides detections for the following anomalies:

    • Suspicious CONTEXT structures: Identifies structures pointing to VirtualProtect functions (targeting techniques used by Foliage and Ekko).
    • MZ/PE Header Validation: Validates headers in memory to detect process hollowing variants.
    • Unbacked Executable Regions: Detects executable memory regions running at high integrity that are not backed by a file on disk.
    • Module Stomping/Overwriting: Detects modified code used in module stomping or overwriting techniques.
    • General Anomalies: Identifies various other memory-based anomalies.