Media Summary: Using direct kernel object manipulation ( Elevate current core to dispatch level, then all cores to dispatch level as well, then go through the active Hide process through NtQuerySystemInformation Hooking
Using direct kernel object manipulation ( Elevate current core to dispatch level, then all cores to dispatch level as well, then go through the active Hide process through NtQuerySystemInformation Hooking
![[Windows DKOM] Hide Process Driver](https://i.ytimg.com/vi/Z8WT-VsV94M/mqdefault.jpg)
Hide Process Driver
![[DKOM] Process Hide Detector](https://i.ytimg.com/vi/MpkZU9wqEcM/mqdefault.jpg)
Basic
Using direct kernel object manipulation (
Elevate current core to dispatch level, then all cores to dispatch level as well, then go through the active
t0rchwo0d.github.io/
Simple technique to
changing protected
Hidden process
Hide process through NtQuerySystemInformation Hooking
![[Process Unlinker] - Hiding Windows user-mode processes](https://i.ytimg.com/vi/B72OrC2VXuo/mqdefault.jpg)
[
Drive
Hide Process By Rootkit
Patchguard