I'm compiling a list of techniques to hide a process. So far this is what I have:
- Hooking SSDT
- Detouring APIs
- Manipulating PsActiveProcessList
- Creating a thread in an arbitrary process? (thus avoiding the creation of a process altogether)
I'm particularly interested in DKOM type of techniques
- Hooking SSDT
- Detouring APIs
- Manipulating PsActiveProcessList
- Creating a thread in an arbitrary process? (thus avoiding the creation of a process altogether)
I'm particularly interested in DKOM type of techniques