This technique was introduced by the CyberArk research team in 2017. It abuses a new feature that was introduced by Intel called Intel Processor Trace (Intel PT). This technology allows debugging software to trace single processes, user-mode and kernel-mode execution, or perform instruction pointer tracing. This Intel PT technology was designed for performance monitoring, diagnostic code coverage, debugging, fuzzing, malware analysis, and exploit detection.
Intel processors and their Performance Monitoring Unit (PMU) capture some information about the process' performance, store them in packets, and deliver these packets to the debugging software in a preallocated memory buffer. When this buffer gets full or almost full, the CPU executes a callback routine to handle the memory space issue. This callback function (that is, the PMI handler) is a function that is targeted by the malware as it gets executed in the context of the running thread that...
