One Method Malware Uses to Bypass Detection

[mattfrog]

So how does malware evade detection when starting new rogue processes? Easy—it directly attacks the operating system’s kernel. Microsoft provides the kernel routine PsSetCreateProcessNotifyRoutine to allow security software to monitor process creation and termination events in the Windows kernel, and security software calls the PsSetCreateProcessNotifyRoutine in order to be notified by the kernel when these events occur. These security solutions will then act on process creation and termination events in order to track system activity and protect critical resources.

http://blog.fireeye.com/research/201...nitoring-.html

[kareldjag]

Hi
Known method and nothing new under the sun for this marketing blog post (our product is better than other blah blah blah...).
Since the rise of modern rootkits any serious security AV or security vendor has improved its product to stay valuable in this highly competitive industry.

Rgds

[Mrkvonic]

I call that TL ; DR.
Mrk