Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 814733" data-attributes="member: 32260">If you mean hooking, then AV stops for a moment the execution of real code of the executed program. The hooks are prepared for some popular APIs. Next, AV modules analyze that code, which is placed somewhere in the memory. After this, the code is blocked (if suspicious) or allowed. Here is an example:&quot;Security software will hook specific user space API functions that are commonly used by malware. For example, a code hook installed on winsock.connect can examine the IP and port of an outgoing network connection and decide whether the connection should be allowed or blocked. A combination of hooks installed on OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread detect malicious process injection. &quot;[URL unfurl=&quot;true&quot;]https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/white-papers/Universal_Unhooking.pdf[/URL]AV can also run the program in the sandbox to analyze the effects of running it, but this is another feature.The PsCreateProcessNotifyRoutine is a routine in the kernel, it can be installed by a driver. It can be also used by AV to monitor process creation and termination events in the Windows kernel.</blockquote>

[QUOTE="Andy Ful, post: 814733, member: 32260"] If you mean hooking, then AV stops for a moment the execution of real code of the executed program. The hooks are prepared for some popular APIs. Next, AV modules analyze that code, which is placed somewhere in the memory. After this, the code is blocked (if suspicious) or allowed. Here is an example: "[I]Security software will hook specific user space API functions that are commonly used by malware. For example, a code hook installed on winsock.connect can examine the IP and port of an outgoing network connection and decide whether the connection should be allowed or blocked. A combination of hooks installed on OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread detect malicious process injection.[/I] " [URL unfurl="true"]https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/white-papers/Universal_Unhooking.pdf[/URL] AV can also run the program in the sandbox to analyze the effects of running it, but this is another feature. The PsCreateProcessNotifyRoutine is a routine in the kernel, it can be installed by a driver. It can be also used by AV to monitor process creation and termination events in the Windows kernel. [/QUOTE]

Verification