Blog

Security Research

Abusing VBS Enclaves to Create Evasive Malware

Ori David is a Security Researcher at Akamai. His research is focused on offensive security, malware analysis, and threat hunting.

Malware that manages to run inside an enclave can be potentially invisible to memory-based detection and forensics.

Contents

1. Introduction

2. Virtual Trust Levels

3. What are VBS enclaves?

4. Enclave malware

5. Detection

6. Conclusion

7. Acknowledgments

<p id="introduction" data-cmp-data-layer="{"introduction":{"@type":"akamai/components/title","repo:modifyDate":"2025-02-24T18:49:04Z","dc:title":"Introduction

\r\n"}}">

Introduction

Virtualization-based security (VBS) is one of the most fascinating recent security advancements.…