Cristian Done is a Security Researcher within Keysight’s Application and Threat Intelligence Research Center. Cristian is an eager to learn type of person who like to constantly improve. With a BE in Computer Engineering and a MS in Advanced Cybersecurity, he is in particular interested in cybersecurity, low level programming and algorithms. He spends most of the time investigating recent vulnerabilities and integrating them in Keysight’s security products.

Monitoring malware behavior through kernel syscall tracing

Threat actors implement new methods of evasion constantly. One solution to monitor malicious activity generated by an application is the use of sandboxes. Up until recently, much of a malware’s behavior could be observed via userland hooking of the target process. However, there are more and more techniques that allow one to bypass such hooking mechanisms and hide its true objectives and behavior. Tools such as SysWhispers can be used to perform system call directly and thus avoid the ordinary users-space behavior tracking.  

In order to gain more insight for such use cases we suggest using an alternative method of observing malware behavior by using a kernel driver for Windows based systems. Through this presentation we will an in-depth view of how an individual can create a Windows kernel driver for performing system call tracing on recent versions of windows, running on recent CPUs. 

This presentation is co-presented with Mihai Vasilescu, Security Research Engineer at Keysight Technologies Romania.