Kyle Avery: Evading Memory Scanners — Bypassing YARA and PE-sieve

Kyle Avery: Evading Memory Scanners — Bypassing YARA and PE-sieve https://peertube.eqver.se/videos/watch/99b46866-7de9-46a0-97bd-aaeaf24ccd76 A DEF CON 30 talk about techniques for evading memory analysis tools used by antivirus products and researchers to detect malware in Windows. The presentation explains how popular scanners such as PE-sieve, Moneta, MalMemDetect, Volatility malfind, and YARA rules detect indicators of compromise in memory. It demonstrates how malware implants and shellcode can be modified to evade these detection methods. The talk also introduces a new position-independent reflective DLL loader called AceLdr, designed for stealthy loading and successful evasion of memory scanners. Fri, 24 Jul 2026 11:29:43 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.eqver.se Kyle Avery: Evading Memory Scanners — Bypassing YARA and PE-sieve https://peertube.eqver.se/client/assets/images/icons/icon-512x512.png https://peertube.eqver.se/videos/watch/99b46866-7de9-46a0-97bd-aaeaf24ccd76 All rights reserved, unless otherwise specified in the terms specified at https://peertube.eqver.se/about and potential licenses granted by each content's rightholder.