Detects and collects information about the presence of rootkits on host endpoints that use I/O request packets (IRPs), system service descriptor table (SSDT) hooks, and interrupt descriptor table (IDT) hooks. This audit may find legitimate hooks, such as those used by antivirus software.
This audit was formerly known as the w32kernel-hookdetection audit.
Supported Platforms
Windows only
Input Parameters
The following input parameters are available for this audit.
idt
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should verify certain entries in the IDT. |
ssdt_index
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should verify the System Service Descriptor Table (SSDT). |
ssdt_inline
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should check the System Service Descriptor Table's (SSDT) functions for modifications in their prologues. |
drivers
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should check the system drivers for IRP hooks. |
memory file
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | FilePath | Valid values are a full file path and file name. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the full path and file name of the file that represents the host endpoint's physical memory. |
Verify Digital Signatures
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should verify that the hooked and hooking modules are digitally signed. This operation cannot be performed on a memory image. |
Prevent Hibernation
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed. |