Layered Compile-Time String Transformation: Detection First

Layers change confidence, not fundamentals

Layered transformation means data is encoded or rearranged through more than one stage before use. That can appear in commercial software protection and in malicious files. A detection that relies only on a readable indicator may lose precision or recall, while a detection based on signer, execution lineage, memory allocation pattern, outbound destination, and persistence activity remains useful.

Analyst workflow

1. Start with source, signature, prevalence, and parent process.
2. Use capa and PE metadata to classify behavior candidates.
3. In an authorized sandbox, collect process, file, registry, module-load, and network observations.
4. Reconcile findings with EDR and identity events before containment.

Detection and hardening

Alert on suspicious combinations such as a newly observed unsigned process, unusual script-host lineage, abnormal private executable memory, and a rare external destination. Maintain application-control policy, block untrusted macro and script paths, and retain enough endpoint telemetry to reconstruct sequences. Do not tune out a class because a legitimate protected application resembles it; constrain exceptions by signer, path, and owner.

Vulnerability context

CVE-2022-30190 (Follina) showed how an initial document could invoke unexpected execution paths. The defensive lesson is to control document handling, patch affected systems, and detect suspicious descendant processes. Static transformation is not the vulnerability; it is a reason to avoid depending on one static indicator.