Blog

No posts match this category.

• PlugX kernel signed-drivers rootkit YARA
  A Look into PlugX Kernel driver
  Jan 21, 2024 6 min read Malware Analysis

  Analysis of a signed PlugX kernel driver used as a user-mode loader via services.exe and svchost.exe.

• drivers kernel ZwQuerySystemInformation Practical-Reverse-Engineering
  Loaded Drivers Enumeration
  Aug 20, 2022 3 min read Windows Internals

  Kernel-mode approach to enumerate loaded drivers every 10 minutes using ZwQuerySystemInformation and a DPC timer.

• APC kernel Practical-Reverse-Engineering injection
  Asynchronous Procedure Calls (APC) Enumeration
  Aug 13, 2022 10 min read Windows Internals

  Stable kernel/user APC queue enumeration across Windows versions using process suspension, IRQL elevation, and careful queue walking.