Xcon2005_Profiling_Malware_and_Rootkits_from_Ke..

More documents

Recommendations

Info

Better Method…Windows Executive ObjectsHow does the Object Manager track so manytypes of objects?It doesn’t “memorize” all these executive objecttypesInstead, executive object types are registereddynamicallyThere are set of callbacks for each object type,and it is responsible for opening, creating,securing, and closing that object type
Better Method…ExampleDuring system initialization, IoInitSytsem()registers the FILE_OBJECT typeLater you call NtCreateFile() to create a new file:This calls ObCreateObject(name, FILE_OBJECT)The Object Manager calls the Open callbackwith the mode set to Create routine registed forthe FILE_OBJECTIf the Open callback returns successfully, thenthe handle is returned to NtCreateFile
Page 2: AgendaBasics about RootkitsCurrent
Page 5 and 6: Rootkit DetectionAt the beginning o
Page 7 and 8: Rootkit Detection Anti-VirusVery ef
Page 9 and 10: Rootkit Detection Host IPSTwo layer
Page 11 and 12: Rootkit DetectionExecution Path Ana
Page 13 and 14: Rootkit Detection DifferentialQuery
Page 15 and 16: Rootkit Technologies IntroductionUs
Page 17 and 18: Rootkit TechnologiesGetting into Ke
Page 19 and 20: Rootkit TechnologiesGetting into Ke
Page 21 and 22: Better Method…IntroductionCan be
Page 23: Better Method…Windows Executive O
Page 27 and 28: Better Method…In the callback, we
Page 29 and 30: Better Method…How ToIf we want to
Page 31 and 32: Detecting Driver LoadingCreating se
Page 33 and 34: Detecting Dispatch HooksEnumerate D
Page 35 and 36: Removing a Rootkit…Still experime
Page 37 and 38: Self-Preservation: Step 1Prevent a
Page 39 and 40: Self-Preservation: Step 3Ensure no
Page 41 and 42: SummaryPresented a method of observ
Page 43 and 44: STKIT- Shok Toolkit JRemember this

Xcon2005_Profiling_Malware_and_Rootkits_from_Ke..

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?