4 ms·

I understand that once a rootkit is installed, all bets are off. I was wondering if the syscalls by which the rootkit gets installed will be obfuscated to make

I understand that once a rootkit is installed, all bets are off. I was wondering if the syscalls by which the rootkit gets installed will be obfuscated to make them look more like a benign/normal process, and evade detection by a malware-syscall-pattern-recognizer. or are some malware syscall patterns essentially "unhideable"?

ShroudedNight 10y ago
Will there be attempts to hide system call patterns from intrusion detection / prevention systems if they take off? Probably, yes: https://www.eecs.berkeley.edu/~daw/papers/mimicry.pdf https://www.eecs.berkeley.edu/~daw/papers/mimicry.pdf Will they work? Maybe: https://web.cs.dal.ca/~zincir/bildiri/pst08-gn.pdf https://web.cs.dal.ca/~zincir/bildiri/pst08-gn.pdf Disclaimer: I was one of Anil Somayaji's grad students at one point in the not so distant past.