Re: Tool Release: ProcL - Detect Hidden Process
- From: Pallav Khandhar <nightrover@xxxxxxxxx>
- Date: Fri, 1 Aug 2008 12:40:45 +0530
Greetings,
I am glad to release ProcL v1.0. ProcL employs many different methods to detect hidden processes. Essentially, ProcL detailed and implemented a mechanism to embed all these different approaches in one tool to detect hidden processes. Our methods of detecting hidden processes requires the examination of each kernel object - EPROCESS, ETHREADS, HANDLES, JOBS. Therefore, we believe, ProcL would defeat process concealment from one certain method.
Hiding a process is particularly threatening because it represents some malicious code running on your system that you are completely unaware of. Process hiding has a significant effect. Many of the trojan, virus, spyware, rootkit writers use similar techniques to hide themselves and stay undetected as long as possible on target machines. Finding all the ways a rootkit might hide a process is just the first step in defending against the rootkits. Detecting hidden objects is a promising new area in rootkit detection.
For more information on the tool
http://www.scanit.net/rd/tools/03
Download the tool
http://www.scanit.net/files/tools/ProcL.zip
Cheers,
Pallav Khandhar
Sr. Security Researcher
Scanit R&D Lab
- Next by Date: Step-by-step instructions for debugging Cisco IOS using gdb
- Next by thread: Step-by-step instructions for debugging Cisco IOS using gdb
- Index(es):
Relevant Pages
|
