The LACUNA Chain’s “Ghost Frames” technique introduces a new method for manipulating call stacks that effectively bypasses modern Endpoint Detection and Response (EDR) systems, which rely on kernel-level stack inspection. This marks a significant advancement in post-exploitation tactics.
Security researcher Mohamed Alzhrani has described this technique as a continuation of previous research known as “HookChain,” which focused on targeting user-mode EDR hooks in NTDLL.
While the earlier methods used indirect syscalls and Import Address Table (IAT) manipulation to evade user-mode monitoring, EDR vendors have since moved telemetry collection into the Windows kernel.
This evolution has rendered those earlier techniques inadequate. Modern defenses now capture execution call stacks at the kernel level using methods like ETW Threat Intelligence (ETW-Ti) and kernel callbacks, which can expose malicious shellcode even when user-mode evasion is successful.
LACUNA Chain Ghost Frames Technique
The LACUNA Chain directly addresses this shift by manipulating how call stacks are interpreted during kernel collection. Rather than trying to hide execution, it creates syntactically valid, semantically plausible call stacks composed entirely of trusted memory regions within signed Windows DLLs.
This is accomplished through an innovative concept known as “ghost frames,” which exploits gaps in Windows exception-handling metadata.
At the core of the technique is the discovery that the Windows unwinding function RtlVirtualUnwindRtlVirtualUnwind treats addresses without associated RUNTIME_FUNCTIONRUNTIME_FUNCTION entries as legitimate leaf functions.
These gaps, uncovered regions between functions in the .pdata.pdata section, exist across all major Windows DLLs, including ntdll.dll, kernelbase.dll, win32u.dll, and wow64.dll.
When encountered, the unwinder simply advances the stack pointer by 8 bytes without validation, allowing attackers to chain these gaps as fake stack frames without modifying memory or triggering anomalies.
Alzhrani’s analysis identified thousands of such gaps, including over 1,000 “ghost functions” within ntdll alone, executable code regions lacking unwind metadata.
These ghost functions provide stable, trusted addresses that appear legitimate during forensic analysis, forming the foundation of the Bring Your Own Unwind Data Gap (BYOUD-Gap) technique. By chaining multiple gap addresses, attackers can effectively “skip” real execution frames and replace them with benign-looking call traces.
Technique components vs purpose:
| Component | Primary purpose | Key surface targeted |
|---|---|---|
| BYOUD-Gap | Build ghost frames without .pdata modification | Call-stack integrity / unwind logic |
| ETW-Ti APC Window | Control when the stack snapshot is taken | ETW-Ti STACKWALK timing |
| Win32u NOP Gap Chain | Provide whitelisted leaf frames inside win32u | Module-of-origin and whitelist rules |
| Ghost Functions (ntdll/kernelbase/wow64) | Create semantically plausible frames near high-value APIs | Semantic stack analysis |
| BYOUD-RT | Compute stack distance at runtime | Pre-calibration requirements |
| BYOUD-MF | Arbitrary RSP teleport in a single frame | Stack layout assumptions / CET synergy |
| Parameter Encryption + VEH | Hide syscall parameters at rest | User-mode hooks / memory scanning |
In parallel, the research highlights a timing weakness in ETW-Ti stack collection. Unlike synchronous kernel callbacks, ETW-Ti captures call stacks asynchronously via user-mode APCs.
This creates a window where attackers can execute malicious operations, then clean and reconstruct the stack before the snapshot occurs. Known as the “ETW-Ti APC Window Attack,” this technique allows precise control over what the EDR ultimately records.
The LACUNA Chain further strengthens evasion through multiple innovations, including runtime stack calculations (BYOUD-RT), machine-frame-based stack-pointer teleportation (BYOUD-MF), and parameter encryption via hardware breakpoints.
Combined, these techniques eliminate reliance on traditional return-address tampering, making them compatible with modern protections such as Intel CET shadow stacks.
A notable enhancement involves leveraging win32u.dll, which contains over 1,200 uniform 8-byte NOP gaps between syscall stubs. These gaps serve as deterministic, allowed leaf frames that blend seamlessly into legitimate call stacks.
Additionally, “ghost proximity” techniques place fake frames near high-value APIs such as VirtualProtect, making them indistinguishable from real execution paths.
In testing across enterprise EDR platforms, including Elastic, Bitdefender, and Kaspersky, the full LACUNA Chain consistently bypassed call-stack-based detection, ETW-Ti stack tracing, and shadow stack validation.
The only remaining detection surface involved behavioral signals from kernel callbacks, which are inherently noisier and prone to false positives.
The research underscores a critical limitation in current defensive models: call-stack telemetry, long considered a reliable signal, can no longer be trusted in isolation. The absence of detection mechanisms for .pdata.pdata gaps represents a systemic blind spot that attackers can exploit without leaving forensic artifacts.
As EDR vendors continue to adapt, the study suggests future detection strategies must focus on identifying anomalous gap addresses in call traces and correlating behavior across multiple telemetry sources. Until then, the LACUNA Chain represents one of the most advanced and stealthy EDR bypass techniques publicly documented.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
