New Moonwalk++ PoC Shows How Malware Can Spoof Windows Call Stacks and Evade Elastic-Inspired Rules

Moonwalk++ is a published proof-of-concept demonstrating sophisticated call-stack spoofing, module resolution evasion, and in-memory encryption techniques that can bypass modern endpoint detection systems; the authors released code and documentation and reported that several popular detection tools failed to detect the technique during testing.