One Method Malware Uses to Bypass Detection

mattfrog · Jun 22, 2012

So how does malware evade detection when starting new rogue processes? Easy—it directly attacks the operating system’s kernel. Microsoft provides the kernel routine PsSetCreateProcessNotifyRoutine to allow security software to monitor process creation and termination events in the Windows kernel, and security software calls the PsSetCreateProcessNotifyRoutine in order to be notified by the kernel when these events occur. These security solutions will then act on process creation and termination events in order to track system activity and protect critical resources.
Click to expand...

http://blog.fireeye.com/research/2012/06/bypassing-process-monitoring-.html

kareldjag · Jun 23, 2012

Hi
Known method and nothing new under the sun for this marketing blog post (our product is better than other blah blah blah...).
Since the rise of modern rootkits any serious security AV or security vendor has improved its product to stay valuable in this highly competitive industry.

Rgds

Mrkvonic · Jun 23, 2012

I call that TL ; DR.
Mrk

Log in or Sign up

One Method Malware Uses to Bypass Detection

mattfrog Registered Member

kareldjag Registered Member

Mrkvonic Linux Systems Expert

Log in or Sign up

One Method Malware Uses to Bypass Detection

mattfrog Registered Member

kareldjag Registered Member

Mrkvonic Linux Systems Expert

Useful Searches