Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 947610" data-attributes="member: 32260">I found the source about hooks used by EDRs:CrowdStrike 38 hooksCylance 30 hooksSophos 23 hooksCarbonBlack 33 hooksSymantec 30 hooksDeepInstinct 24 hooksMcAfee 20 hooksCheckPoint SandBlast 49 hooksEset 38 hooksThe malware can unhook the hooks from the userland to weaken/disable some security layers like HIPS, behavior monitoring, etc.Some AVs avoid hooking in the userland and use kernel callbacks, mini-filter drivers, ETW, etc. For example, Defender uses Microsoft-Windows-Threat-Intelligence (ETW provider). They can be bypassed via kernel exploits. Bypassing the AV feature via exploiting the kernel is very hard when it is protected by hardware-assisted virtualization. If I correctly remember KIS uses hardware virtualization for Safe Money, some other AVs can use it to harden auto-sandboxes, etc. On Windows 10 hardware-assisted virtualization (Virtualization-Based Security) can be introduced via Core Isolation settings and GPO. It is compatible with Defender but there can be problems with other AVs. Some VBS features are not available on Windows Home and Pro, also VBS requires additional hardware and firmware qualifications (will not work on older machines).</blockquote>

[QUOTE="Andy Ful, post: 947610, member: 32260"] I found the source about hooks used by EDRs: CrowdStrike 38 hooks Cylance 30 hooks Sophos 23 hooks CarbonBlack 33 hooks Symantec 30 hooks DeepInstinct 24 hooks McAfee 20 hooks CheckPoint SandBlast 49 hooks Eset 38 hooks The malware can unhook the hooks from the userland to weaken/disable some security layers like HIPS, behavior monitoring, etc. Some AVs avoid hooking in the userland and use kernel callbacks, mini-filter drivers, ETW, etc. For example, Defender uses Microsoft-Windows-Threat-Intelligence (ETW provider). They can be bypassed via kernel exploits. Bypassing the AV feature via exploiting the kernel is very hard when it is protected by hardware-assisted virtualization. If I correctly remember KIS uses hardware virtualization for Safe Money, some other AVs can use it to harden auto-sandboxes, etc. On Windows 10 hardware-assisted virtualization (Virtualization-Based Security) can be introduced via Core Isolation settings and GPO. It is compatible with Defender but there can be problems with other AVs. Some VBS features are not available on Windows Home and Pro, also VBS requires additional hardware and firmware qualifications (will not work on older machines). [/QUOTE]

Verification