Rootkits (Part 2): High-Level Techniques

Rootkit techniques are used by malicious software (malware) to hide their presence on an infected system. In this video, Sourcefire Chief Scientist, Zulfikar Ramzan, describes the high level techniques used by kernel-mode and user-mode rootkits. These techniques include direct code modification, import address table hook, system services dispatch table, and direct kernel object modification. For a comprehensive list of chalk talks, please visit http://sourcefire.com/chalktalks.