AltFS Fileless File System Aims to Evades Detection by Security Software

guest · Feb 27, 2019

AltFS Fileless File System Aims to Evades Detection by Security Software
February 27, 2019
https://www.bleepingcomputer.com/ne...ims-to-evades-detection-by-security-software/

Exclusive: Researchers from SafeBreach have developed an open source library that creates a fileless file system residing in operating system resources such as the Windows Registry, WMI, or the user defaults system in macOS. This system was created to illustrate how a fileless file system framework could be created to help security software properly detect them.
Click to expand...

In order to stay persistent over reboots attackers will be required to write some files to disk or store PowerShell commands to download and reinstall malware. This, though, increases the chances of being detected.

As research into creating a persistent fileless file system that is not easily detected, security researcher Dor Azouri from SafeBreach has released an open source python library called AltFS and released it on GitHub.

When BleepingComputer asked SafeBreach if they have tested whether their AltFS file system can be detected by security software, they had stated that they plan on testing this in the future. Their focus at this time time is to demonstrate a fileless framework for researchers to play with and contribute to in order to improve it.
Click to expand...

Log in or Sign up

AltFS Fileless File System Aims to Evades Detection by Security Software

guest Guest

Log in or Sign up

AltFS Fileless File System Aims to Evades Detection by Security Software

guest Guest

Useful Searches