<— Back

Ghost Math: Syscall‑Only Injection, Deterministic Shellcode & QUIC C2 — A Modern EDR Bypass Monograph

This monograph presents a 72-hour red-team campaign engineered to subvert two leading Endpoint Detection & Response (EDR) platforms—CrowdStrike Falcon (sensor v5.66) and Microsoft Defender for Endpoint (MDE, build 2309)—plus a Zeek 6 + Suricata 7 network inspection stack.

The operation hinged on three research pillars:

1. Thread-less, syscall-only process injection, eliminating the canonical handle → RW → CreateThread → DLL Load heuristic.
2. Deterministic “mathematical” shellcode that reconstructs itself on the victim in 38 ms from trigonometric constants, erasing static payload artefacts.
3. QUIC/HTTP-3 command-and-control that mimics Chrome 121 JA3 fingerprints and rides inside Google CDN domain fronting.

We document the full attacker workflow, enumerate every EDR alert generated (with timestamps, rule IDs and severity), and analyse exactly why each detection triggered or failed, mapping countermeasures to MITRE ATT&CK v14. Defender-ready Sigma, Splunk SPL and Osquery artefacts are appended.