Detecting and Triaging Modern Windows Rootkits | Andrew Case
Summary: Andrew Case presented a May 2023 Volexity Cyber Sessions talk on detecting and triaging modern Windows rootkits, covering techniques that rootkit developers adapted to evade Microsoft's newer kernel protections, including Driver Signing Enforcement enabled by default, an updated Patch Guard, and new kernel-level logging. The talk walks through the most commonly observed examples of these techniques, including those used by a variety of APT groups, and uses a mix of event log analysis and memory forensics to showcase methods that automatically detect them.
Key Takeaway: Rootkit developers have already adapted to Microsoft's default driver signing enforcement and updated Patch Guard, and the techniques shown are attributed to a variety of APT groups - meaning kernel-level persistence is an active adversary capability, not a legacy one.
Read the original at Volexity Blog ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026