Demystifying Modern Windows Rootkits
Bill Demirkapi demystifies writing modern Windows kernel rootkits, demonstrating novel kernel hooking techniques to manipulate user-mode network stacks.
Summary
The Evolution of Windows Kernel Security
Modern Windows operating systems deploy Kernel Patch Protection (PatchGuard) and Driver Signature Enforcement (DSE) to prevent unauthorized kernel modification.
Building a Modern Windows Rootkit from Scratch
Bill Demirkapi walks through the complete lifecycle of kernel driver development, transitioning from a basic driver to an advanced stealth rootkit.
Novel Kernel Hooking and Network Stack Manipulation
Demirkapi reveals undocumented hooking primitives in kernel drivers to intercept and manipulate user-mode socket communications without triggering PatchGuard crashes.
Kernel-Mode vs. User-Mode Tradeoffs and Defenses
The presentation analyzes the operational drawbacks of kernel implants and outlines detection engineering strategies for security teams monitoring kernel telemetry.
Related talks
Main Stage·31 min
Bill Demirkapi
Bill Demirkapi answers community questions regarding modern Windows kernel development, PatchGuard interactions, and network driver hooks.
Main Stage·24 min
Omri Misgav
Omri Misgav investigates Bring Your Own Vulnerable Driver (BYOVD) attacks, subverting Windows Driver Signature Enforcement to deploy stealthy kernel rootkits.
Main Stage·42 min
Tomer Bar · Eran Segal
SafeBreach researchers analyze five years of Windows CVE patterns to predict recurring vulnerability classes and discover new zero-day local privilege escalations.