{"id":224951,"date":"2000-01-24T11:15:00","date_gmt":"2000-01-24T10:15:00","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/"},"modified":"2000-01-24T11:15:00","modified_gmt":"2000-01-24T10:15:00","slug":"anti-forensics-dissimulation-de-processus-windows-en-kernel-mode","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/","title":{"rendered":"Anti-Forensics : Dissimulation de processus Windows en kernel mode"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/forensics.1280x600-862x404-1.jpg\" alt=\"\" class=\"wp-image-11235\" width=\"982\" height=\"460\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cet article est la premi\u00e8re it\u00e9ration d\u2019une s\u00e9rie d\u2019articles visant \u00e0 pr\u00e9senter un \u00e9ventail de techniques utilis\u00e9es par les logiciels malveillants pour se propager et dissimuler leur pr\u00e9sence sur les diff\u00e9rentes cibles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La grande majorit\u00e9 de ces techniques a \u00e9t\u00e9 d\u00e9couverte et pr\u00e9sent\u00e9e il y a plusieurs ann\u00e9es par des chercheurs en s\u00e9curit\u00e9. Le but de l\u2019approche pr\u00e9sente est de construire et organiser une base de connaissance sur les aspects syst\u00e8mes (d\u00e9fensifs et offensifs) et les aspects identification\/forensics (r\u00e9ponse \u00e0 incident) de ces techniques.<br>En plus de la pr\u00e9sentation de ces aspects un code source de type Proof of Concept en C pourra \u00eatre trouv\u00e9 sur&nbsp;<a href=\"https:\/\/github.com\/devoteam-fr\/CERT\">le Github du CERT<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S\u2019ajouteront \u00e0 cette base de connaissance&nbsp;les \u00e9l\u00e9ments techniques rencontr\u00e9s sur le terrain par l\u2019\u00e9quipe de r\u00e9ponse \u00e0 incident de Devoteam.<br>Ce premier article pr\u00e9sentera la technique nomm\u00e9e&nbsp;<strong>DKOM process hiding<\/strong>&nbsp;suivant le plan suivant :<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Repr\u00e9sentation des processus sous Windows<\/li><li>Dissimulation par Direct Kernel Object Modification<\/li><li>Impl\u00e9mentation<\/li><li>D\u00e9tection en RAM avec Volatility<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Le concept, pr\u00e9sent\u00e9 en 2004 \u00e0 la Black Hat USA a \u00e9t\u00e9 et est utilis\u00e9 par de nombreux rookits kernel mode comme le tr\u00e8s connu FU-rootkit, d\u00e9velopp\u00e9 par Jamie Butler (\u00e9galement auteur de la pr\u00e9sentation susmentionn\u00e9e).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Repr\u00e9sentation des processus sous Windows<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Le kernel Windows repr\u00e9sente les processus par des structures&nbsp;<strong>EPROCESS<\/strong>.<br>Ces structures sont opaques : peu document\u00e9es par Microsoft et non d\u00e9taill\u00e9es par des headers standards.<br>R\u00e9f\u00e9rence MSDN:&nbsp;<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/ff544273(v=vs.85).aspx.\">EPROCESS (Windows Driver)<\/a><\/p>\n\n\n\n<p class=\"has-text-align-left wp-block-paragraph\">Elles sont malgr\u00e9 tout observables via le debugging kernel, avec&nbsp;<strong>KD<\/strong>&nbsp;:<\/p>\n\n\n\n<div class=\"wp-block-image is-style-default wp-duotone-000000-ffffff-1\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/report0-1-1024x170-1.png\" alt=\"\" class=\"wp-image-11217\" width=\"619\" height=\"103\" \/><figcaption>R\u00c9CUP\u00c9RATION DE POINTEUR VERS EPROCESS AVEC KD<\/figcaption><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.02.53-1296x189.png\" alt=\"\" class=\"wp-image-11237\" width=\"622\" height=\"90\" \/><figcaption>LISTING DES CHAMPS EPROCESS AVEC KD<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">La structure contient 207 champs (dans notre exemple avec Windows 10 64 bits).<br>Le focus sera mis sur trois champs de cette structure dont :<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.03.35.png\" alt=\"\" class=\"wp-image-11238\" width=\"366\" height=\"19\" \/><figcaption>CHAMP PID DANS KD<\/figcaption><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.03.47.png\" alt=\"\" class=\"wp-image-11239\" width=\"432\" height=\"27\" \/><figcaption>LE NOM D\u2019EX\u00c9CUTABLE<\/figcaption><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.04.01.png\" alt=\"\" class=\"wp-image-11240\" width=\"437\" height=\"64\" \/><figcaption>STRUCTURE DE TYPE LIST_ENTRY<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Cette liste contient deux liens :&nbsp;<strong>Flink<\/strong>&nbsp;et&nbsp;<strong>Blink<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ces liens sont int\u00e9ressants car ils pointent vers deux structures\u00a0<strong>LIST_ENTRY<\/strong>\u00a0appartenant respectivement au processus pr\u00e9c\u00e9dent<em>\u00a0(Backlink)<\/em>\u00a0et au processus suivant\u00a0<em>(Forwardlink)<\/em>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.05.40.png\" alt=\"\" class=\"wp-image-11242\" width=\"833\" height=\"379\" \/><figcaption>REPR\u00c9SENTATION D\u2019ACTIVEPROCESSLINKS ENTRE TROIS PROCESSUS<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\">Tous les processus d\u2019un syst\u00e8me se r\u00e9f\u00e9rencent donc les uns aux autres via des pointeurs dans leur structure<strong>\u00a0ActiveProcessLinks<\/strong>. Ils forment une liste doublement cha\u00een\u00e9e utilis\u00e9e par les outils Windows tels que\u00a0<strong>taskmgr.exe<\/strong>\u00a0(gestionnaire des t\u00e2ches) ou certains outils de SysInternals comme\u00a0<strong>procexp.exe<\/strong>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.04.48.png\" alt=\"\" class=\"wp-image-11241\" width=\"519\" height=\"428\" \/><figcaption>REPR\u00c9SENTATION DES LIENS ENTRE PROCESSUS<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ces outils parcourent cette liste p\u00e9riodiquement pour mettre \u00e0 jour l\u2019affichage des processus.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Dissimulation par Direct Kernel Object Modification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">La technique&nbsp;<strong>DKOM process hiding<\/strong>&nbsp;permet de cacher un processus en d\u00e9r\u00e9f\u00e9ren\u00e7ant les&nbsp;<strong>ActiveProcessLinks<\/strong>&nbsp;de ce dernier et en reliant le processus \u00ab pr\u00e9c\u00e9dent \u00bb directement au processus \u00ab suivant \u00bb.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.cert-devoteam.fr\/wp-content\/uploads\/2017\/01\/report7-1.png\" alt=\"\" class=\"wp-image-1027\" \/><figcaption>REPR\u00c9SENTATION GRAPHIQUE D\u2019UNE ATTAQUE DKOM<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Sortir notre processus (<em>smss.exe<\/em>\u00a0dans l\u2019exemple imag\u00e9) de la liste doublement cha\u00een\u00e9e le rend invisible aux outils parcourant cette derni\u00e8re pour r\u00e9cup\u00e9rer tous les processus.<br>Le fait de d\u00e9r\u00e9f\u00e9rencer le processus n\u2019impacte en aucun cas son fonctionnement. En effet, l\u2019ordonnanceur alloue du temps processeur aux threads unitairement, sans consid\u00e9rer la notion de processus.<br>Les liens\u00a0<strong>Blink<\/strong>\u00a0et\u00a0<strong>Flink<\/strong>\u00a0du processus sont modifi\u00e9s pour pointer vers leur propre structure\u00a0<strong>ActiveProcessLinks<\/strong>\u00a0afin de ne pas lever d\u2019erreur \u00e0 la fin de l\u2019ex\u00e9cution du processus. S\u2019ils pointent vers d\u2019anciennes adresses ou des valeurs al\u00e9atoires le kernel risque de lever une erreur \u00e0 la mise \u00e0 jour des processus \u00ab\u00a0voisins\u00a0\u00bb.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.06.44.png\" alt=\"\" class=\"wp-image-11243\" width=\"673\" height=\"527\" \/><figcaption>LIENS ENTRE PROCESSUS AVEC DISSIMULATION DU PROCESSUS DE PID 64<\/figcaption><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Impl\u00e9mentation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Commentaires sur le PoC en version 0.1<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Le code pr\u00e9sent sur\u00a0<a href=\"https:\/\/github.com\/devoteam-fr\/CERT\">le github du CERT\u00a0<\/a>est le code d\u2019un driver de test, il part du code d\u2019exemple de driver Windows utilisant le<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/hh439665(v=vs.85).aspx\">\u00a0Kernel-Mode Driver Framework.<\/a><br>Lors de son initialisation le driver va chercher, via\u00a0<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/ff551302(v=vs.85).aspx\"><strong>WDF_DRIVER_CONFIG_INIT()<\/strong><\/a>, un processus dont le nom (champ\u00a0<strong>ImageFileName<\/strong>\u00a0de\u00a0<strong>EPROCESS<\/strong>\u00a0mentionn\u00e9 pr\u00e9c\u00e9demment) est\u00a0<strong>virus.exe<\/strong>\u00a0et va le dissimuler en utilisant la technique d\u00e9crite auparavant.<br>Cette impl\u00e9mentation n\u2019est pas un Rootkit fonctionnel et ne sert que d\u2019exemple \u00e0 titre \u00e9ducatif.<br>Le code utilise des offsets m\u00e9moire test\u00e9s sur un Windows 10 64bits mis \u00e0 jour le 02 Janvier 2017. Ces offsets permettent d\u2019acc\u00e9der aux diff\u00e9rents champs de la structure\u00a0<strong>EPROCESS<\/strong>\u00a0et ont de grandes chances de ne pas fonctionner sur d\u2019autres versions de Windows.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.07.25.png\" alt=\"\" class=\"wp-image-11244\" width=\"479\" height=\"149\" \/><figcaption>OFFSETS M\u00c9MOIRES EPROCESS UTILIS\u00c9S<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Les offsets pr\u00e9sent\u00e9s ci-dessus peuvent \u00eatre retrouv\u00e9s dans les captures r\u00e9alis\u00e9es avec&nbsp;<strong>KD<\/strong>&nbsp;dans la partie&nbsp;<em>Repr\u00e9sentation des processus sous Windows<\/em>.<br>Le code peut \u00eatre ais\u00e9ment am\u00e9lior\u00e9 pour s\u2019affranchir de la limite li\u00e9e \u00e0 la version de Windows et offrir une interface de contr\u00f4le user land.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Acc\u00e8s et modification des EPROCESS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">L\u2019API de Windows ne fournit pas de structure<strong>\u00a0EPROCESS<\/strong>\u00a0mais fournit des m\u00e9thodes permettant de r\u00e9cup\u00e9rer un pointeur vers ce dernier.<br>La fonction utilis\u00e9e dans le cas du PoC est\u00a0<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/hardware\/ff559933(v=vs.85).aspx\">PsGetCurrentProcess()<\/a>, qui retourne un pointeur vers la structure\u00a0<strong>EPROCESS<\/strong>\u00a0du processus courant.<br>Dans le contexte d\u2019ex\u00e9cution de notre driver, elle retourne un pointeur vers la structure\u00a0<strong>EPROCESS<\/strong>\u00a0du processus System.<br>Une fois ce pointeur r\u00e9cup\u00e9r\u00e9 une fonction de recherche est appel\u00e9e afin de parcourir la liste des\u00a0<strong>EPROCESS<\/strong>\u00a0\u00e0 la recherche de l\u2019<strong>ImageFileName virus.exe<\/strong>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/report10-1-1024x383-1.png\" alt=\"\" class=\"wp-image-11247\" width=\"628\" height=\"235\" \/><figcaption>CORPS DE FONCTION PRINCIPAL<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Si la recherche retourne une structure\u00a0<strong>EPROCESS<\/strong>, alors les\u00a0<strong>ActiveProcessLinks\u00a0<\/strong>de ce dernier sont modifi\u00e9s afin de le dissimuler.<br>Cette op\u00e9ration est r\u00e9alis\u00e9e via manipulation directe des structures\u00a0<strong>EPROCESS<\/strong>\u00a0en m\u00e9moire.<\/p>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.10.06.png\" alt=\"\" class=\"wp-image-11248\" width=\"588\" height=\"300\" \/><figcaption>FONCTION DE DISSIMULATION DKOM<\/figcaption><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Pertinence et protections existantes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Le driver g\u00e9n\u00e9r\u00e9 par le code du PoC a \u00e9t\u00e9 soumis \u00e0 l\u2019analyse des Antivirus fournis par la plateforme https:\/\/nodistribute.com\/ et n\u2019a lev\u00e9 aucune alerte.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.10.38.png\" alt=\"\" class=\"wp-image-11249\" width=\"642\" height=\"219\" \/><figcaption>R\u00c9SULTAT DE L\u2019ANALYSE ANTIVIRUS DU POC<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ce r\u00e9sultat est directement li\u00e9 \u00e0 la simplicit\u00e9 du code et au faible nombre d\u2019appels syst\u00e8mes requis pour faire fonctionner la technique.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cette technique n\u2019est cependant pas stable sur toutes les versions de syst\u00e8mes d\u2019exploitation Windows.<br>En effet, une protection int\u00e9gr\u00e9e \u00e0 Windows 64 bits nomm\u00e9e&nbsp;<strong>PatchGuard<\/strong>&nbsp;peut d\u00e9tecter les manipulations pr\u00e9c\u00e9demment d\u00e9crites.<br>PatchGuard, aussi appel\u00e9 Kernel Patch Protection (<strong>KPP<\/strong>), a \u00e9t\u00e9 introduit dans Windows XP 64 bits et Windows Server 2003 SP1 en 2005.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ce m\u00e9canisme, tr\u00e8s peu document\u00e9 par Microsoft, permet de v\u00e9rifier la consistance des structures Kernel et \u00e9viter les m\u00e9thodes de patching et hooking par un driver.<br><strong>KPP<\/strong>&nbsp;effectue des v\u00e9rifications r\u00e9guli\u00e8res sur une fr\u00e9quence al\u00e9atoire, il peut se passer des dizaines de minutes sans v\u00e9rification. Lorsqu\u2019une anomalie a \u00e9t\u00e9 d\u00e9couverte pendant une de ces v\u00e9rifications une erreur kernel de type&nbsp;<strong>0x109 \u2013 CRITICAL_STRUCTURE_CORRUPTION<\/strong>&nbsp;est lev\u00e9e et entra\u00eene l\u2019arr\u00eat brutal du syst\u00e8me.<br><strong>KPP<\/strong>&nbsp;n\u2019emp\u00eache donc pas la bonne ex\u00e9cution de la technique mais arr\u00eate le syst\u00e8me sans sommation.<br>\u00c9tant donn\u00e9 que cette technique est utilis\u00e9e principalement pour dissimuler une pr\u00e9sence, la g\u00e9n\u00e9ration syst\u00e9matique de \u00ab blue screen \u00bb de la part de&nbsp;<strong>KPP<\/strong>&nbsp;la rend inefficace.<br>La protection n\u2019\u00e9tant impl\u00e9ment\u00e9e que dans les versions 64 bits de Windows, elle laisse les syst\u00e8mes 32 bits vuln\u00e9rables. A ce jour la plupart des installations de nouveaux postes sont effectu\u00e9es en 64 bits, rendant cette menace quasi-obsol\u00e8te.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La m\u00e9thode ne doit pas \u00eatre ignor\u00e9e pour autant, et ce pour deux raisons :<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Une r\u00e9ponse \u00e0 incident sur des syst\u00e8mes Windows 32 bits peut amener \u00e0 la rencontrer<\/li><li>Des attaques contre&nbsp;<strong>PatchGuard<\/strong>&nbsp;existent (et feront l\u2019objet d\u2019une analyse future)<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">D\u00e9tection en RAM avec Volatility<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">La d\u00e9tection de la technique est relativement ais\u00e9e \u00e0 l\u2019aide d\u2019une capture de RAM, en comparaison \u00e0 la d\u00e9tection sur un poste infect\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En effet, une partie des&nbsp;outils de diagnostic live (e.g. suite&nbsp;<a href=\"https:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb842062.aspx\">SysInternals&nbsp;<\/a>de Microsoft) se base sur la liste doublement cha\u00een\u00e9e des processus.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A des fins de d\u00e9monstration, le PoC a \u00e9t\u00e9 ex\u00e9cut\u00e9 sur un syst\u00e8me Windows 10 Professionnel en version 14393.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Illustration avec&nbsp;<em>Process Explorer<\/em>,&nbsp;<em>VMMap<\/em>,&nbsp;<em>ListDlls<\/em>&nbsp;et&nbsp;<em>Handle64<\/em>, ex\u00e9cut\u00e9s sur le syst\u00e8me du PoC<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/11_procexp.png\" alt=\"\" class=\"wp-image-11251\" width=\"558\" height=\"252\" \/><figcaption>PROCESSUS INVISIBLE POUR PROCESS EXPLORER<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/13_vmmap.png\" alt=\"\" class=\"wp-image-11252\" width=\"522\" height=\"534\" \/><figcaption>PROCESSUS INVISIBLE POUR VMMAP<\/figcaption><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/14_dll_handles.png\" alt=\"\" class=\"wp-image-11253\" width=\"451\" height=\"45\" \/><figcaption>R\u00c9F\u00c9RENCES VERS DLLS ET HANDLES ABSENTES<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">En revanche, le processus existe bien et ses \u00e9v\u00e9nements peuvent \u00eatre r\u00e9cup\u00e9r\u00e9s avec les bons filtres pour le\u00a0<em>Process Monitor<\/em>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/12_procmon.png\" alt=\"\" class=\"wp-image-11254\" width=\"443\" height=\"213\" \/><figcaption>D\u00c9COUVERTE DE L\u2019ACTIVIT\u00c9 DU PROCESSUS CACH\u00c9 AVEC PROCESS MONITOR<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"caption-attachment-1135\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En dehors du cas trivial choisi comme exemple, les rootkits peuvent modifier et d\u00e9tourner un grand nombre de fonctionnalit\u00e9s syst\u00e8mes, il est conseill\u00e9 d\u2019investiguer hors-ligne, sur un dump de RAM avec un framework adapt\u00e9 comme&nbsp;<a href=\"http:\/\/www.volatilityfoundation.org\/\">Volatility<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La\u00a0version de Windows mentionn\u00e9e pr\u00e9c\u00e9demment est support\u00e9e par Volatility 2.6 avec le profil\u00a0<strong>Win10x64_14393<\/strong>.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/00_win_version.png\" alt=\"\" class=\"wp-image-11255\" width=\"349\" height=\"97\" \/><figcaption>VERSION UTILIS\u00c9E POUR LES TESTS<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">La capture m\u00e9moire a \u00e9t\u00e9 r\u00e9alis\u00e9e avec l\u2019outil\u00a0<strong>Winpmem<\/strong>, distribu\u00e9 par le\u00a0<a href=\"https:\/\/github.com\/google\/rekall\/wiki\">projet Rekall\u00a0<\/a>de Google.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/01_winpmem0.png\" alt=\"\" class=\"wp-image-11256\" width=\"659\" height=\"387\" \/><figcaption>CAPTURE DE M\u00c9MOIRE AVEC WINPMEM<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Il peut \u00eatre observ\u00e9, lors de l\u2019identification des \u00e9l\u00e9ments r\u00e9cup\u00e9r\u00e9s par\u00a0<strong>winpmem<\/strong>, le driver d\u00e9velopp\u00e9 pr\u00e9c\u00e9demment (son nom est ici\u00a0<em>2017_remote_helloworld<\/em>).<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/02_winpmem1-1024x74-1.png\" alt=\"\" class=\"wp-image-11257\" width=\"761\" height=\"55\" \/><figcaption>APPARITION DU DRIVER DANS LES LOGS WINPMEM<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois la capture de m\u00e9moire \u00e0 disposition, l\u2019investigation peut d\u00e9marrer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Volatility poss\u00e8de un certain nombre de plugins pour analyser les processus en cours d\u2019ex\u00e9cution sur le dump, une comparaison de ces plugins peut \u00eatre r\u00e9alis\u00e9e de la mani\u00e8re suivante :<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/Capture-de\u0301cran-2022-01-24-a\u0300-12.13.47-1296x189.png\" alt=\"\" class=\"wp-image-11258\" width=\"466\" height=\"67\" \/><figcaption>LANCEMENT DES DIFF\u00c9RENTS PLUGINS DE D\u00c9TECTION DE PROCESSUS<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">En analysant les r\u00e9sultats, seuls les plugins\u00a0<em>psscan<\/em>\u00a0et\u00a0<em>psxview\u00a0<\/em>ont trouv\u00e9 l\u2019existence de notre processus cach\u00e9.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/04_virus_found-1024x164-1.png\" alt=\"\" class=\"wp-image-11259\" width=\"500\" height=\"80\" \/><figcaption>D\u00c9TECTION DU PROCESSUS PAR PSSCAN ET PSXVIEW<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">La documentation de ces plugins permet de comprendre l\u2019apparition ou non du processus cach\u00e9 dans les r\u00e9sultats de ces derniers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/volatilityfoundation\/volatility\/wiki\/Command-Reference#pslist\">pslist<\/a>&nbsp;\u2013 d\u00e9tection des processus via parcours de la liste doublement cha\u00een\u00e9e (cible de l\u2019attaque)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/volatilityfoundation\/volatility\/wiki\/Command-Reference#pstree\">pstree<\/a>&nbsp;\u2013 utilise la m\u00eame technique que pslist, pr\u00e9sente simplement les r\u00e9sultats diff\u00e9remment<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/volatilityfoundation\/volatility\/wiki\/Command-Reference#psscan\">psscan<\/a>&nbsp;\u2013 scanne la m\u00e9moire \u00e0 la recherche de structures _POOL_HEADER (groupement de pages m\u00e9moire) pour identifier les processus qui y sont associ\u00e9s<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/volatilityfoundation\/volatility\/wiki\/Command-Reference-Mal#psxview\">psxview<\/a>&nbsp;\u2013 combinaison de plusieurs techniques, une par colonne :<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>pslist<\/strong>&nbsp;parcours de la liste doublement cha\u00een\u00e9e<\/li><li><strong>psscan<\/strong>&nbsp;_POOL_HEADER scan<\/li><li><strong>thrdproc<\/strong>&nbsp;thread scan, r\u00e9cup\u00e8re la liste des _KTHREAD utilis\u00e9e par le scheduler (ne peut \u00eatre modifi\u00e9e comme indiqu\u00e9 pr\u00e9c\u00e9demment) et la parcoure \u00e0 la recherche des _EPROCESS associ\u00e9s<\/li><li><strong>pspcid<\/strong><\/li><li><strong>csrss&nbsp;<\/strong>csrss.exe maintient une liste ind\u00e9pendante des processus qui peut \u00eatre r\u00e9cup\u00e9rable en scannant sa m\u00e9moire<\/li><li><strong>session<\/strong><\/li><li><strong>deskthrd<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Psxview<\/em>&nbsp;est en quelque sorte le plugin le plus rapide et efficace pour la d\u00e9tection des processus cach\u00e9s, il offre la plus grande couverture parmi les autres modules de Volatility.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Il est maintenant \u00e9tabli que dans cette capture, le processus cach\u00e9 s\u2019appelle&nbsp;<em>virus.exe<\/em>&nbsp;et a le PID 4952, l\u2019investigation peut continuer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Le PID ne peut \u00eatre utilis\u00e9 directement par les plugins de Volatility dans le cas d\u2019un processus cach\u00e9 de cette mani\u00e8re, la r\u00e9f\u00e9rence \u00e0 utiliser doit \u00eatre son offset m\u00e9moire.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/05_pid_not_found-1024x80-1.png\" alt=\"\" class=\"wp-image-11260\" width=\"665\" height=\"52\" \/><figcaption>TENTATIVE DE R\u00c9CUP\u00c9RATION DES HANDLES VIA PID<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">L\u2019offset m\u00e9moire (P pour physique) peut \u00eatre pass\u00e9 \u00e0 la quasi totalit\u00e9 des plugins Volatility pour identifier un process, en lieu et place de son PID.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avec cette information il est par exemple possible de r\u00e9cup\u00e9rer :<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>les&nbsp;<a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724457(v=vs.85).aspx\">handles<\/a>&nbsp;ouverts vers des ressources du syst\u00e8me d\u2019exploitation (fichier, cl\u00e9 de registre\u2026).<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/06_offset_found-1024x156-1.png\" alt=\"\" class=\"wp-image-11261\" \/><figcaption>R\u00c9CUP\u00c9RATION DES HANDLES EN UTILISANT L\u2019OFFSET M\u00c9MOIRE DU PROCESSUS<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li>La ligne de commande \u00e0 l\u2019origine du processus<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/07_cmdline_found-1024x90-1.png\" alt=\"\" class=\"wp-image-11262\" \/><figcaption>R\u00c9CUP\u00c9RATION DE LA LIGNE DE COMMANDE ASSOCI\u00c9E AU PROCESSUS<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Le driver\/rootkit peut \u00e9galement \u00eatre r\u00e9cup\u00e9r\u00e9 dans le dump de m\u00e9moire.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.cert-devoteam.fr\/wp-content\/uploads\/2017\/01\/08_driver_founds-1024x66.png\" alt=\"\" class=\"wp-image-1087\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.cert-devoteam.fr\/wp-content\/uploads\/2017\/01\/09_mod_dump-1024x246.png\" alt=\"\" class=\"wp-image-1088\" \/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.cert-devoteam.fr\/wp-content\/uploads\/2017\/01\/10_driver_dump_found.png\" alt=\"\" class=\"wp-image-1089\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">R\u00e9f\u00e9rences<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em><br>Direct Kernel Object Manipulation. Jamie Butler, Black Hat 2004.<br>The Rootkit Arsenal, Escape and Evasion in the dark Corners of the System. Bill Blunden, 2013.<br>FU rootkit source code, Jamie Butler.<br>FUTo rootkit source code, Peter Silberman.<br>Windows Internals, Mark Russinovich, David A. Solomon, Alex Ionescu, 2012.<br>Microsoft Developer Network, https:\/\/msdn.microsoft.com\/<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Cet article est la premi\u00e8re it\u00e9ration d\u2019une s\u00e9rie d\u2019articles visant \u00e0 pr\u00e9senter un \u00e9ventail de techniques utilis\u00e9es par les logiciels malveillants pour se propager et dissimuler leur pr\u00e9sence sur les diff\u00e9rentes cibles. La grande majorit\u00e9 de ces techniques a \u00e9t\u00e9 d\u00e9couverte et pr\u00e9sent\u00e9e il y a plusieurs ann\u00e9es par des chercheurs en s\u00e9curit\u00e9. Le [&hellip;]<\/p>\n","protected":false},"featured_media":0,"template":"","categories":[],"tags":[],"industry":[],"class_list":["post-224951","expert-view","type-expert-view","status-publish","hentry"],"acf":[],"cards":"\n\t<div class=\"single-post-card\">\n\n\t\t\n\n\t\t\n\t\t<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-43282307 wp-block-group-is-layout-flex\">\n\t<p style=\"font-style:normal;font-weight:700\" class=\"has-link-color wp-elements-1 wp-block-lp-post-type has-text-color has-primary-color has-small-font-size\">Parole d'experts<\/p>\n\n\t\t\n\t\t<h3 style=\"font-style:normal;font-weight:400\" class=\"wp-block-post-title has-base-font-size\"><a href=\"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/\" target=\"_self\" >Anti-Forensics : Dissimulation de processus Windows en kernel mode<\/a><\/h3><\/div>\n\t\t\n\t<\/div>\n\n","yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.4 (Yoast SEO v28.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Anti-Forensics : Dissimulation de processus Windows en kernel mode | Devoteam<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Anti-Forensics : Dissimulation de processus Windows en kernel mode\" \/>\n<meta property=\"og:description\" content=\"Introduction Cet article est la premi\u00e8re it\u00e9ration d\u2019une s\u00e9rie d\u2019articles visant \u00e0 pr\u00e9senter un \u00e9ventail de techniques utilis\u00e9es par les logiciels malveillants pour se propager et dissimuler leur pr\u00e9sence sur les diff\u00e9rentes cibles. La grande majorit\u00e9 de ces techniques a \u00e9t\u00e9 d\u00e9couverte et pr\u00e9sent\u00e9e il y a plusieurs ann\u00e9es par des chercheurs en s\u00e9curit\u00e9. Le [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/\" \/>\n<meta property=\"og:site_name\" content=\"Devoteam\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data1\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/\",\"url\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/\",\"name\":\"Anti-Forensics : Dissimulation de processus Windows en kernel mode | Devoteam\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/france.devoteam.com\\\/wp-content\\\/uploads\\\/sites\\\/21\\\/2022\\\/01\\\/forensics.1280x600-862x404-1.jpg\",\"datePublished\":\"2000-01-24T10:15:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/#primaryimage\",\"url\":\"https:\\\/\\\/france.devoteam.com\\\/wp-content\\\/uploads\\\/sites\\\/21\\\/2022\\\/01\\\/forensics.1280x600-862x404-1.jpg\",\"contentUrl\":\"https:\\\/\\\/france.devoteam.com\\\/wp-content\\\/uploads\\\/sites\\\/21\\\/2022\\\/01\\\/forensics.1280x600-862x404-1.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Parole d'experts\",\"item\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/expert-view\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Anti-Forensics : Dissimulation de processus Windows en kernel mode\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/\",\"name\":\"Devoteam\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/devoteam.info\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Anti-Forensics : Dissimulation de processus Windows en kernel mode | Devoteam","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/","og_locale":"fr_FR","og_type":"article","og_title":"Anti-Forensics : Dissimulation de processus Windows en kernel mode","og_description":"Introduction Cet article est la premi\u00e8re it\u00e9ration d\u2019une s\u00e9rie d\u2019articles visant \u00e0 pr\u00e9senter un \u00e9ventail de techniques utilis\u00e9es par les logiciels malveillants pour se propager et dissimuler leur pr\u00e9sence sur les diff\u00e9rentes cibles. La grande majorit\u00e9 de ces techniques a \u00e9t\u00e9 d\u00e9couverte et pr\u00e9sent\u00e9e il y a plusieurs ann\u00e9es par des chercheurs en s\u00e9curit\u00e9. Le [&hellip;]","og_url":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/","og_site_name":"Devoteam","twitter_card":"summary_large_image","twitter_misc":{"Dur\u00e9e de lecture estim\u00e9e":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/","url":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/","name":"Anti-Forensics : Dissimulation de processus Windows en kernel mode | Devoteam","isPartOf":{"@id":"https:\/\/devoteam.info\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/#primaryimage"},"image":{"@id":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/#primaryimage"},"thumbnailUrl":"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/forensics.1280x600-862x404-1.jpg","datePublished":"2000-01-24T10:15:00+00:00","breadcrumb":{"@id":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/#primaryimage","url":"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/forensics.1280x600-862x404-1.jpg","contentUrl":"https:\/\/france.devoteam.com\/wp-content\/uploads\/sites\/21\/2022\/01\/forensics.1280x600-862x404-1.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/devoteam.info\/fr\/expert-view\/anti-forensics-dissimulation-de-processus-windows-en-kernel-mode\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devoteam.info\/fr\/"},{"@type":"ListItem","position":2,"name":"Parole d'experts","item":"https:\/\/devoteam.info\/fr\/expert-view\/"},{"@type":"ListItem","position":3,"name":"Anti-Forensics : Dissimulation de processus Windows en kernel mode"}]},{"@type":"WebSite","@id":"https:\/\/devoteam.info\/fr\/#website","url":"https:\/\/devoteam.info\/fr\/","name":"Devoteam","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devoteam.info\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"}]}},"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Julien Pawlowski","author_link":"https:\/\/devoteam.info\/fr\/author\/"},"uagb_comment_info":0,"uagb_excerpt":"Introduction Cet article est la premi\u00e8re it\u00e9ration d\u2019une s\u00e9rie d\u2019articles visant \u00e0 pr\u00e9senter un \u00e9ventail de techniques utilis\u00e9es par les logiciels malveillants pour se propager et dissimuler leur pr\u00e9sence sur les diff\u00e9rentes cibles. La grande majorit\u00e9 de ces techniques a \u00e9t\u00e9 d\u00e9couverte et pr\u00e9sent\u00e9e il y a plusieurs ann\u00e9es par des chercheurs en s\u00e9curit\u00e9. Le\u2026","_links":{"self":[{"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/expert-view\/224951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/expert-view"}],"about":[{"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/types\/expert-view"}],"version-history":[{"count":0,"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/expert-view\/224951\/revisions"}],"wp:attachment":[{"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/media?parent=224951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/categories?post=224951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/tags?post=224951"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/devoteam.info\/fr\/wp-json\/wp\/v2\/industry?post=224951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}