Recently, I've learned how some rootkits are able to hide certain files, services, etc. from programs in the kernel or user modes.
This got me wondering: Are there any antivirus programs, or other intrusion detection systems, that use "canary files" with common strings in their filenames that are normally hidden by rootkits to detect these?
MyRootkit.vir is known to hide files which include the string ".vir" in their filename.
2.) Upon installation (or signature update)
MyRootkitcanary.vir in C:\Program Files\MyAV\Canary Files\
3.) During a scan,
cmd -c dir "C:\Program Files\MyAV\Canary Files\"
MyRootkitcanary.vir is not included in the system's response,
MyAV alerts that the system may be infected with