{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T17:59:25Z","timestamp":1790877565593,"version":"4.1.0"},"reference-count":67,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2024,11,1]],"date-time":"2024-11-01T00:00:00Z","timestamp":1730419200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Italian Ministry of University and Research"},{"name":"MUR PRIN 2022","award":["CUP E53D23007950001"],"award-info":[{"award-number":["CUP E53D23007950001"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2024,11]]},"DOI":"10.1109\/tdsc.2024.3376129","type":"journal-article","created":{"date-parts":[[2024,3,12]],"date-time":"2024-03-12T18:57:12Z","timestamp":1710269832000},"page":"5374-5387","source":"Crossref","is-referenced-by-count":12,"title":["Laccolith: Hypervisor-Based Adversary Emulation With Anti-Detection"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0820-8995","authenticated-orcid":false,"given":"Vittorio","family":"Orbinato","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering and Information Technology, Università degli Studi di Napoli Federico II, Naples, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0130-3981","authenticated-orcid":false,"given":"Marco Carlo","family":"Feliciano","sequence":"additional","affiliation":[{"name":"Secureware s.r.l, Naples, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7103-592X","authenticated-orcid":false,"given":"Domenico","family":"Cotroneo","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering and Information Technology, Università degli Studi di Napoli Federico II, Naples, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1084-4824","authenticated-orcid":false,"given":"Roberto","family":"Natella","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering and Information Technology, Università degli Studi di Napoli Federico II, Naples, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991111"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.06.001"},{"key":"ref3","article-title":"Design issues of modern EDRs: Bypassing ETW-based solutions","year":"2021"},{"key":"ref4","article-title":"Sliver","year":"2021"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102500"},{"key":"ref6","volume-title":"Statistical Inference for Data Science","author":"Caffo","year":"2016"},{"key":"ref7","first-page":"1","article-title":"Kypo\u2013A platform for cyber defence exercises","volume-title":"Proc. M&S Support Oper. Tasks Including War Gaming, Logistics, Cyber Defence","author":"\u010celeda","year":"2015"},{"key":"ref8","article-title":"Tracking GhostNet: Investigating a cyber espionage network","year":"2021"},{"key":"ref9","article-title":"Bypass EDR\u2019s memory protection, introduction to hooking","author":"Plaa","year":"2019"},{"key":"ref10","article-title":"MITRE ATT&CK","year":"2019"},{"key":"ref11","article-title":"OilRig adversary plan","year":"2021"},{"key":"ref12","article-title":"OilRig intelligence summary","year":"2021"},{"key":"ref13","article-title":"Invoke-adversary","year":"2020"},{"key":"ref14","article-title":"FireEye EDR bypassed with basic process injection","year":"2017"},{"key":"ref15","article-title":"APT34: The Helix Kitten cybercriminal group loves to meow Middle Eastern and international organizations","year":"2018"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/s10479-021-04442-0"},{"key":"ref17","article-title":"Shikata-ga-nai","year":"2020"},{"key":"ref18","article-title":"Red team automation","year":"2018"},{"key":"ref19","article-title":"Center for threat-informed defense","year":"2015"},{"key":"ref20","article-title":"Staying hidden on the endpoint: Evading detection with shellcode","author":"Pena","year":"2016"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2014.27"},{"key":"ref22","first-page":"191","article-title":"A virtual machine introspection based architecture for intrusion detection","volume-title":"Proc. Netwo. Distrib. Syst. Secur. Symp.","volume":"3","author":"Garfinkel","year":"2003"},{"key":"ref23","article-title":"Infection monkey","year":"2015"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384742"},{"key":"ref25","article-title":"Bypass EDR\u2019s memory protection, introduction to hooking","author":"Bui","year":"2023"},{"key":"ref26","article-title":"Evade EDR with shellcode injection and gain persistence using registry run keys","year":"2021"},{"key":"ref27","article-title":"XCHG - Exchange register\/memory with register","year":"2019"},{"key":"ref28","article-title":"Carbanak APT: The great bank robbery","year":"2019"},{"key":"ref29","article-title":"Inceptor","year":"2017"},{"key":"ref30","article-title":"Inceptor\u2013Bypass AV-EDR solutions combining well-known techniques","year":"2022"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2014.6838298"},{"key":"ref32","article-title":"LibVirt","year":"2020"},{"key":"ref33","article-title":"APT34 targets Jordan government using new Saitama backdoor","year":"2020"},{"key":"ref34","article-title":"M-Trends","year":"2020"},{"key":"ref35","article-title":"New targeted attack in the Middle East by APT34, a suspected Iranian threat group, using CVE-2017-11882 exploit","year":"2020"},{"key":"ref36","article-title":"Shikata Ga Nai Encoder Still Going Strong","year":"2020"},{"key":"ref37","article-title":"Collection of powershell scripts","author":"Fleschutz","year":"2020"},{"key":"ref38","article-title":"API reference docs for windows driver kit (WDK)","year":"2020"},{"key":"ref39","article-title":"Microsoft defender application guard overview","year":"2021"},{"key":"ref40","article-title":"Microsoft defender smartscreen","year":"2018"},{"key":"ref41","volume-title":"MITRE, Account Discovery, T1087","year":"2014"},{"key":"ref42","volume-title":"MITRE, CALDERA","year":"2021"},{"key":"ref43","article-title":"Exfiltration over alternative protocol, T1048","volume-title":"MITRE","year":"2013"},{"key":"ref44","article-title":"OS credential dumping, T1003","volume-title":"MITRE","year":"2003"},{"key":"ref45","volume-title":"MITRE, Phishing, T1566","year":"2022"},{"key":"ref46","article-title":"Use alternate authentication material: Pass the hash, T1550.002","volume-title":"MITRE","year":"2015"},{"key":"ref47","article-title":"Use execution: Malicious file, T1204.002","volume-title":"MITRE","year":"2020"},{"key":"ref48","volume-title":"Nextron Systems GmbH, APTSimulator","year":"2021"},{"key":"ref49","volume-title":"Paranoid Ninja, CarbonCopy","year":"2013"},{"key":"ref50","article-title":"Qemu","volume-title":"Qemu","year":"2022"},{"key":"ref51","article-title":"Atomic red team","volume-title":"Red Canary","year":"2019"},{"key":"ref52","article-title":"Linux-KVM","volume-title":"RedHat","year":"2017"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.2196\/jmir.2076"},{"key":"ref54","first-page":"1","article-title":"Galaxy: A network emulation framework for cybersecurity","volume-title":"Proc. 11th USENIX Workshop Cyber Secur. Experimentation Test","author":"Schoonover","year":"2018"},{"key":"ref55","article-title":"Bypassing cylance and other AVs\/EDRs by unhooking windows APIs","volume-title":"Spot the planet","year":"2020"},{"key":"ref56","article-title":"Mitre att&ck: Design and philosophy","author":"Strom","year":"2018","journal-title":"MITRE Corporation"},{"key":"ref57","article-title":"Finding cyber threats with ATT&CK-based analytics","author":"Strom","year":"2017"},{"key":"ref58","article-title":"W32.Stuxnet dossier","year":"2020","journal-title":"Symantec Security Response"},{"key":"ref59","article-title":"DumpsterFire","volume-title":"TryCatchHCF","year":"2019"},{"key":"ref60","article-title":"Metta","volume-title":"Uber Technologies Inc","year":"2018"},{"key":"ref61","article-title":"Volatility","volume-title":"Volatility Foundation","year":"2016"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-33769-2_3"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101636"},{"key":"ref64","volume-title":"Windows Internals, Part 1: System Architecture, Processes, Threads, Memory Management, and More","author":"Yosifovich","year":"2017"},{"key":"ref65","article-title":"Heresy\u2019s Gate: Kernel Zw*\/NTDLL Scraping + \u201cWork Out\u201d: Ring 0 to Ring 3 via Worker Factories","volume-title":"Zerosum0x0","year":"2017"},{"key":"ref66","article-title":"Zerosum0x0 GitHub repository","volume-title":"Zerosum0x0","year":"2017"},{"key":"ref67","article-title":"Sok: A survey of open-source threat emulators","author":"Zilberman","year":"2020"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10750463\/10470424.pdf?arnumber=10470424","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,27]],"date-time":"2024-11-27T00:08:12Z","timestamp":1732666092000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10470424\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11]]},"references-count":67,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2024.3376129","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,11]]}}}