Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 824158" data-attributes="member: 32260">[USER=80927]Opcode[/USER], Welcome back and thanks for expanding/correcting my post. It is true that AV vendors can use hypervisors for kernel-mode hooking (I mentioned this in my post), but for now it is used only for some vendors and only for some special tasks. Microsoft is not happy when software vendors use kernel-mode hooking, so there is always a risk that after Windows Update something will go wrong. That is why (probably) AV vendors are still very conservative about this possibility.I was referring to the example from Cylance article without much thinking if it is a good idea <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /> :&quot;Security software will hook specific user space API functions that are commonly used by malware. For example, a code hook installed on winsock.connect can examine the IP and port of an outgoing network connection and decide whether the connection should be allowed or blocked. A combination of hooks installed on OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread detect malicious process injection.&quot;[URL unfurl=&quot;true&quot;]https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/white-papers/Universal_Unhooking.pdf[/URL]</blockquote>

[QUOTE="Andy Ful, post: 824158, member: 32260"] [USER=80927]Opcode[/USER], Welcome back and thanks for expanding/correcting my post. It is true that AV vendors can use hypervisors for kernel-mode hooking (I mentioned this in my post), but for now it is used only for some vendors and only for some special tasks. Microsoft is not happy when software vendors use kernel-mode hooking, so there is always a risk that after Windows Update something will go wrong. That is why (probably) AV vendors are still very conservative about this possibility. I was referring to the example from Cylance article without much thinking if it is a good idea :giggle: : "[I]Security software will hook specific user space API functions that are commonly used by malware. For example, a code hook installed on winsock.connect can examine the IP and port of an outgoing network connection and decide whether the connection should be allowed or blocked. A combination of hooks installed on OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread detect malicious process injection[/I]." [URL unfurl="true"]https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/white-papers/Universal_Unhooking.pdf[/URL] [/QUOTE]

Verification