Technology News and Headlines

How Attackers Hide Processes by Abusing Kernel Patch Protection

Researchers disclosed a new Windows rootkit technique that hides malicious processes by using the legitimate PsSetCreateProcessNotifyRoutineEx API to repair ActiveProcessLinks just before the kernel’s PspProcessDelete validation runs. This timing‑based bypass evades both PatchGuard and Hypervisor‑Protected Code Integrity, allowing processes to disappear from Task Manager and security tools without triggering a bugcheck. Exploitation still demands kernel‑mode code execution, typically via a signed or compromised driver, making deployment challenging but feasible. The finding highlights a shift toward data‑structure manipulation as a stealth vector against hardened Windows kernels.