Skip to content
corpus.blog
Sign in Claim your blog
Record · elastic.co

Call Stacks: No More Free Passes For Malware

Elastic Blog · 11 min read

A post on elastic.co is cited by 3 distinct blogs to date (corpus.blog, measured 11 October 2026).

A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.

Read at elastic.co (opens in a new tab) Wayback capture (opens in a new tab)

3blogs citing

Citing blogs and links by period
Period Blogs Links
All time33
Last 90 days00
Last 30 days00
Last 7 days00
Figures for this page
First cited14 Jul 2025
Latest citation15 Dec 2025
Words blogs link it with3
External links30
Length2,372
New citing blogs a weeksince Jul 2025
New citing blogs a week, since Jul 2025: 65 weeks, peak 1 a week, latest week 0

0 this week (still settling) · peak 1

Show as table
New citing blogs a week, week by week
Week of Value
14 Jul 20251
21 Jul 20250
28 Jul 20250
4 Aug 20250
11 Aug 20250
18 Aug 20250
25 Aug 20250
1 Sept 20250
8 Sept 20250
15 Sept 20250
22 Sept 20250
29 Sept 20250
6 Oct 20251
13 Oct 20250
20 Oct 20250
27 Oct 20250
3 Nov 20250
10 Nov 20250
17 Nov 20250
24 Nov 20250
1 Dec 20250
8 Dec 20250
15 Dec 20251
22 Dec 20250
29 Dec 20250
5 Jan 20260
12 Jan 20260
19 Jan 20260
26 Jan 20260
2 Feb 20260
9 Feb 20260
16 Feb 20260
23 Feb 20260
2 Mar 20260
9 Mar 20260
16 Mar 20260
23 Mar 20260
30 Mar 20260
6 Apr 20260
13 Apr 20260
20 Apr 20260
27 Apr 20260
4 May 20260
11 May 20260
18 May 20260
25 May 20260
1 Jun 20260
8 Jun 20260
15 Jun 20260
22 Jun 20260
29 Jun 20260
6 Jul 20260
13 Jul 20260
20 Jul 20260
27 Jul 20260
3 Aug 20260
10 Aug 20260
17 Aug 20260
24 Aug 20260
31 Aug 20260
7 Sept 20260
14 Sept 20260
21 Sept 20260
28 Sept 20260 (still settling)
5 Oct 20260 (still settling)

Each blog counts once, in the week of its first citation. A blog added to the index recently can bring old first citations in at once.

Words blogs link it with

The words blogs link this page with, by how many different blogs use them.

  • call stack analysis1 blog
  • call stacks: no more free passes for malware1 blog
  • marrying call stack analysis with telemetry1 blog

Cited by 3 blogs in 3 posts

One row per blog, the most recently citing first. Each shows the blog's newest citing post; open a row for the others.

Blog
Newest citing post
Date
klezvirus.github.io1 post
Malware Just Got Its Free Passes Back!

linked as “Call Stacks: No More Free Passes For Malware”

Read at klezvirus.github.io (opens in a new tab)
15 Dec 2025
rastamouse.me1 post
Crystal Kit

linked as “call stack analysis”

Read at rastamouse.me (opens in a new tab)
12 Oct 2025
aff-wg.org1 post
Taking them to the SHITTER: an analysis of vendor abuse of security research in-the-wild

linked as “marrying call stack analysis with telemetry”

Read at aff-wg.org (opens in a new tab)
14 Jul 2025

Links from this post

Link
Host
https://en.wikipedia.org/wiki/Stack_(abstract_data_type Who cites this page
en.wikipedia.org
https://www.blackhat.com/docs/us-16/materials/us-16-Pierce-Capturing-0days-With-PERFectly-Placed-Hardware-Traps-wp.pdf Who cites this page
blackhat.com
https://www.microsoft.com/en-us/research/wp-content/uploads/2017/01/griffin-asplos17.pdf Who cites this page
microsoft.com
https://lwn.net/Articles/824613/ Who cites this page
lwn.net
https://github.com/jdu2600/conference_talks/blob/main/2022-04-csidescbr-StackWalking.pdf Who cites this page
github.com
https://codemachine.com/articles/x64_deep_dive.html Who cites this page
codemachine.com
https://en.wikipedia.org/wiki/tail_call Who cites this page
en.wikipedia.org
https://youtu.be/9SqDY0wMmHE Who cites this page
youtu.be
https://learn.microsoft.com/en-us/windows/win32/debug/pe-format Who cites this page
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/microsoft-public-symbols Who cites this page
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/public-and-private-symbols Who cites this page
learn.microsoft.com
https://github.com/search?q=repo%3Aelastic%2Fprotections-artifacts+call_stack_final_user_module&type=code Who cites this page
github.com
http://www.nynaeve.net/?p=200 Who cites this page
nynaeve.net
https://learn.microsoft.com/en-us/windows/win32/procthread/fibers Who cites this page
learn.microsoft.com
Demystifying Shims - or - Using the App Compat Toolkit to make your old stuff work with your new stuff Read at techcommunity.microsoft.com (opens in a new tab)
techcommunity.microsoft.com
Bypassing EDRs With EDR-Preloading Read at malwaretech.com (opens in a new tab)
malwaretech.com
https://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/ Who cites this page
outflank.nl
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/application-verifier Who cites this page
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting Who cites this page
learn.microsoft.com
https://github.com/elastic/protections-artifacts/blob/3537aa4ed9c7ed9dcd04da2efafbad38af47a017/behavior/rules/windows/defense_evasion_virtualprotect_via_vectored_exception_handling.toml Who cites this page
github.com
https://learn.microsoft.com/en-us/windows/win32/sync/asynchronous-procedure-calls Who cites this page
learn.microsoft.com
https://attack.mitre.org/techniques/T1574/013/ Who cites this page
attack.mitre.org
https://www.unknowncheats.me/forum/assembly/88648-spoofing-return-address.html
unknowncheats.me
https://www.welivesecurity.com/2013/08/26/nymaim-obfuscation-chronicles/ Who cites this page
welivesecurity.com
https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs Who cites this page
labs.withsecure.com
https://klezvirus.github.io/RedTeaming/AV_Evasion/StackSpoofing/ Read at klezvirus.github.io (opens in a new tab)
klezvirus.github.io
https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Alessandro%20klezVirus%20Magnosi%20Arash%20waldoirc%20Parsa%20Athanasios%20trickster0%20Tserpelis%20-%20StackMoonwalk%20A%20Novel%20approach%20to%20stack%20spoofing%20on%20Windows%20x64.pdf Who cites this page
media.defcon.org
https://learn.microsoft.com/en-us/sysinternals/downloads/rootkit-revealer Who cites this page
learn.microsoft.com
https://github.com/jdu2600/conference_talks/blob/main/2023-09-bsidescbr-GetInjectedThreadEx.pdf Who cites this page
github.com
https://github.com/jdu2600/Get-InjectedThreadEx/blob/edbff70fc286a3f1c32c6249b3b913d84d70259b/Get-InjectedThreadEx.cpp Who cites this page
github.com
Elsewhere on elastic.co (8)

Something wrong here? Report a problem