Even if it’s sitting in the background under a spoofed process name, it can be caught with memory dumps. Memory dumps are obnoxiously useful for detecting stea

Even if it’s sitting in the background under a spoofed process name, it can be caught with memory dumps. Memory dumps are obnoxiously useful for detecting stealthy malware, especially if you do the memory dumps from the hypervisor instead of from the VM itself. The hard part is parsing :)