Xcon2005_Profiling_Malware_and_Rootkits_from_Ke..

More documents

Recommendations

Info

Rootkit DetectionThree current detection mechanisms:Anti-virus software approachHIPS (Host Intrusion Prevention Systems)Execution Path Analysis (EPA)The newcomer: Differential testing
Rootkit Detection Anti-VirusVery effective at preventing use of knownrootkitsNew signatures are made as new variants<strong>and</strong> rootkits come outDetects the rootkit’s fingerprint before ithas a chance to run
Page 2: AgendaBasics about RootkitsCurrent
Page 5: Rootkit DetectionAt the beginning o
Page 9 and 10: Rootkit Detection Host IPSTwo layer
Page 11 and 12: Rootkit DetectionExecution Path Ana
Page 13 and 14: Rootkit Detection DifferentialQuery
Page 15 and 16: Rootkit Technologies IntroductionUs
Page 17 and 18: Rootkit TechnologiesGetting into Ke
Page 19 and 20: Rootkit TechnologiesGetting into Ke
Page 21 and 22: Better Method…IntroductionCan be
Page 23 and 24: Better Method…Windows Executive O
Page 25 and 26: Better Method…ExampleDuring syste
Page 27 and 28: Better Method…In the callback, we
Page 29 and 30: Better Method…How ToIf we want to
Page 31 and 32: Detecting Driver LoadingCreating se
Page 33 and 34: Detecting Dispatch HooksEnumerate D
Page 35 and 36: Removing a Rootkit…Still experime
Page 37 and 38: Self-Preservation: Step 1Prevent a
Page 39 and 40: Self-Preservation: Step 3Ensure no
Page 41 and 42: SummaryPresented a method of observ
Page 43 and 44: STKIT- Shok Toolkit JRemember this

Xcon2005_Profiling_Malware_and_Rootkits_from_Ke..

Create successful ePaper yourself

Delete template?

Save as template?