SLOW#TEMPEST Obfuscated Control Flow Detection
This rule detects the execution of DLLs that exhibit signs of advanced code obfuscation, such as dynamic jumps (e.g., JMP RAX) or indirect function calls (e.g., CALL RAX). This technique is used by malware like SLOW#TEMPEST to hinder static and dynamic analysis. The rule specifically looks for indicators from an advanced EDR, sandbox, or memory analysis tool.
Splunk (SPL)
