Reply to thread

Message: <blockquote data-quote="In2an3_PpG" data-source="post: 790468" data-attributes="member: 56957">Hi, [USER=76851]@WiseVector[/USER] I'd like to thank you for spending the time to read my questions and respond to them and I do apologize for the delay in this reply. Without further delay... let's just jump right in! <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile    :)" loading="lazy" data-shortname=":)" />1. The officially documented mechanisms for filtering process creation from kernel-mode should be fine for on-execution scanning purposes. Who told you otherwise? I'd love to hear about why it isn't suitable for you.2. There is no point in you trying to justify your decisions by piggybacking off the choices made by a third-party vendor you are not even a partner of - you should be making your own decisions based on your own judgement, otherwise you may as well just be a re-seller for someone else's product.My point of view on the matter is that relying on code injection and API hooking to achieve results that can be achieved without code injection and API hooking (in this case, they can, and the implementation would be far more reliable) is nothing but ignorance.Kind Regards,In2an3_PpG</blockquote>

Top