When Anti-Virus Engines Look Like Kernel Rootkits

While analyzing real-world systems, memory analysts will often encounter anti-virus (AV) engines, EDRs, and similar products that, at first glance, look suspiciously like malware. This occurs because these security products leverage the same techniques commonly employed by malware—such as API hooking, system call hooking, and registering callbacks—in order to gain the insight they need to detect

Print Share Comment Cite Upload Translate

APA

() » When Anti-Virus Engines Look Like Kernel Rootkits. Retrieved from https://www.truth.cx/2020/05/27/when-anti-virus-engines-look-like-kernel-rootkits/.

MLA

" » When Anti-Virus Engines Look Like Kernel Rootkits." - , https://www.truth.cx/2020/05/27/when-anti-virus-engines-look-like-kernel-rootkits/

HARVARD

» When Anti-Virus Engines Look Like Kernel Rootkits., viewed ,

VANCOUVER

- » When Anti-Virus Engines Look Like Kernel Rootkits. [Internet]. [Accessed ]. Available from: https://www.truth.cx/2020/05/27/when-anti-virus-engines-look-like-kernel-rootkits/

CHICAGO

" » When Anti-Virus Engines Look Like Kernel Rootkits." - Accessed . https://www.truth.cx/2020/05/27/when-anti-virus-engines-look-like-kernel-rootkits/

IEEE

" » When Anti-Virus Engines Look Like Kernel Rootkits." [Online]. Available: https://www.truth.cx/2020/05/27/when-anti-virus-engines-look-like-kernel-rootkits/. [Accessed: ]

Select a language: Afrikaans Albanian Arabic Armenian Basque Bengali Bulgarian Catalan Cambodian Chinese (Mandarin) Croatian Czech Danish Dutch English Estonian Fiji Finnish French Georgian German Greek Gujarati Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Javanese Korean Latin Latvian Lithuanian Macedonian Malay Malayalam Maltese Maori Marathi Mongolian Nepali Norwegian Persian Polish Portuguese Punjabi Quechua Romanian Russian Samoan Serbian Slovak Slovenian Spanish Swahili Swedish Tamil Tatar Telugu Thai Tibetan Tonga Turkish Ukrainian Urdu Uzbek Vietnamese Welsh Xhosa While analyzing real-world systems, memory analysts will often encounter anti-virus (AV) engines, EDRs, and similar products that, at first glance, look suspiciously like malware. This occurs because these security products leverage the same techniques commonly employed by malware—such as API hooking, system call hooking, and registering callbacks—in order to gain the insight they need to detect First name:

Last name: