Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces TLSCheck 2.0, an enhanced Volatility 3 plugin for detecting and analyzing TLS callbacks in memory dumps, addressing the challenge of distinguishing legitimate callbacks from malicious ones. The plugin combines PE header analysis, memory structure examination, and disassembly of callback routines to precisely locate TLS callback tables. By incorporating pattern matching with regular expressions and YARA rules, along with instruction-level analysis for suspicious behaviors, TLSCheck 2.0 significantly improves the detection of TLS-based threats.
Uncover hidden malware: TLSCheck 2.0 spots malicious Thread Local Storage (TLS) callbacks lurking in memory dumps with enhanced precision.
Memory analysis is a crucial technique in digital forensics that enables investigators to examine the runtime state of a system through physical memory dumps. While significant advances have been made in memory forensics, the detection and analysis of Thread Local Storage (TLS) callbacks remain challenging due to their dual nature as both legitimate Windows constructs and potential vectors for malware execution. An early version of the TlsCheck plugin received recognition in the Volatility Plugin Contest 2024. In this paper, we present an enhanced version of TlsCheck for Volatility 3, designed to detect and analyze TLS callbacks in process memory. It implements precise detection of TLS callback tables through analysis of PE headers and memory structures, combined with disassembly of identified callback routines. The plugin supports both 32-bit and 64-bit architectures, offering investigators insights into callback locations, assembly behavior, and potential signs of suspicious activity. To enhance detection, we incorporate pattern matching using custom regular expressions and YARA rules, helping analysts identify specific code patterns or suspicious constructs within TLS callbacks. The framework also includes instruction-level analysis to highlight behavior often linked to malware, such as anti-debugging, code injection, and process manipulation. This implementation significantly improves defenders'ability to detect and investigate TLS-based threats during memory forensics, supporting more effective malware analysis and incident response operations.