SilentMoonwalk-style call stack spoofing via kernel32.dll ROP/JOP gadgets

Ibrahim Saud@tektrix

•updated 23 days ago•2•0•2

Detects forged thread call stacks by identifying processes that spoof legitimate thread entry points such as RtlUserThreadStart and BaseThreadInitThunk in kernel32.dll, a technique commonly associated with advanced thread execution hijacking methods like SilentMoonwalk or StackMoonwalk.