Hidden and Hooked Process Detection

Security is the core specialty of Apriorit, and our accumulated experience is formalized in the technology sets we are ready to offer to our clients.

Within the security projects that we work on, we often deal with various types of malicious software. There are a number of signs of such unwanted residents, and hidden files or processes as well as hooked system and other processes are among the major ones. There are a number of ways to perform such illegal actions, from modifying SDT/SST structures, to modifying registry, to using system function splicing techniques, etc. We research these ways and combine corresponding techniques into ready technology sets we deliver to our clients.

Our technology sets are aimed at detecting the following:

• Hidden process detection – using a variety of ways we can detect hidden processes both on kernel level and on user level and block them, if required.
• Hidden files detection – we can conduct full system checks in order to detect hidden files and delete them, if needed.
• Hidden registry entries detection – we can conduct full registry integrity check in order to identify hidden registry entries.
• Hidden driver detection – we can detect and optionally remove any hidden drivers.
• Hooked process detection – we can detect both hooked processes as well as hooked kernel modules (any unauthorized changes to the kernel).

Our Process Management Tools

Depending on the project type – threat detection, antimalware, or incident response system – we use different techniques. We use scanners for detecting malware processes, files, services, and registry entries that are already hidden. We also have monitors for malicious process detection and other corresponding actions in real time. Our hidden rootkit process detection tools allow us to remove hooks and correctly identify details of the perpetrator.

We will be able to customize these technology sets to suit your needs, integrate them in your project, or deliver them as a custom SDK.

We have a number of articles based on our technologies in our blog. You can read our tutorials in order to get a better idea about our technical expertise:

• Simple anti-splicer tutorial
• Simple anti-rootkit tool development tutorial
• Windows DLL Injection into Process Using KnownDlls

 

Mitigating project risks with Apriorit

• Managed development teams – each of our development teams comes with a part-time project manager, who manages day-to-day operations of the team and serves as a single point of contact between the team and the client.
• Delivery on time and within budget – Apriorit has extensive track record of on-time and within budget deliveries. We deliver value according to your business priorities and take responsibility for the quality of delivered code.
• Constantly growing knowledge base – we constantly gather best practices and experience from each project in order to bring more value to the next one. At the same time, Apriorit respects intellectual property rights and strictly adhere to the non-disclosure agreements.

 

If you need to create a solution that employs hidden process detection or hooked process detection, consider Apriorit! 

Back to the list