22

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task manager, you won't see any suspicious activity?

If yes, how can it do that? What techniques can be used to hide in this way?

Improve this question
5

2 Answers 2

Reset to default
47

Yes. There are a number of ways:

  • Directly patch Task Manager's process at runtime so that its enumeration code skips over your process.
  • Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread).
  • Hook the Process32First / Process32Next functions in every process (incl. task manager) to "skip" your process when the enumeration is performed.
  • Hook CreateToolhelp32Snapshot so that the mapped section's memory (see here for how snapshots work) is modified ahead of time, so that Process32First / Process32Next end up reading from fake data.
  • Hook ntdll.dll!NtQuerySystemInformation and, if SystemProcessInformation is passed, patch the results to skip over your process. This is a lower level hook than the above calls.
  • Load a kernel-mode driver which hooks the kernel-mode handler for SystemProcessInformation queries. I don't know the real name for this in Windows (it's not documented) but essentially there's a table of handlers which NtQuerySystemInformation looks through for this purpose, and you just have to hook the right one. Here's the ReactOS implementation of the actual handler. In this you'd just mess with the returned structs so that your process isn't shown.
  • Hook the SSDT to catch the transition between user-mode and kernel-mode for when various process enumeration APIs are called.
  • Use Direct Kernel Object Manipulation (DKOM) to modify the EPROCESS structures in memory so that your process is hidden from the kernel entirely. The kernel maintains a circularly linked list of structures which represent all running processes, with FLink and BLink fields as forward and backward pointers respectively. By manipulating those pointers to jump over your process, then manipulating your process' pointers to go back to themselves, the kernel will skip over your process during enumeration. This is a common rootkit technique.
Improve this answer
12
  • 3
    Depressing how man ways there are :-(
    – aggsol
    Mar 23, 2015 at 10:02
  • 17
    A popular approach is injecting a dll into a common process (e.g. explorer). No need to hide a process if you don't create one.
    – CodesInChaos
    Mar 23, 2015 at 10:04
  • 1
    @Polynomial You don't need any hooks if you don't have a process to hide.
    – CodesInChaos
    Mar 23, 2015 at 10:07
  • 2
    @CodeClown All of these hooks require the attacking process to be running as an administrator. The latter ones require driver load privileges. The solution is not to run malicious code on your system - follow safe practices, enable UAC, use a VM / sandboxing for testing untrusted stuff, run an AV (MSSE is fine), and install and configure EMET to get some additional protection against exploits.
    – Polynomial
    Mar 23, 2015 at 10:33
  • 1
    @DanNeely Process Monitor, as far as I understand, doesn't bother with the toolhelp functions and goes straight to the ntdll stuff, so hooking Process32First/Next won't beat it. Hooking NtQuerySystemInformation should still hide it from ProcExp, as should anything lower down. You'd have to do investigation with a kernel debugger (e.g. WinDbg) to identify hooks at that level. Hidden EPROCESS entries require some more in-depth analysis. Stuff like SSDT / IDT hooks will require forensic memory dumps.
    – Polynomial
    Mar 23, 2015 at 14:38
4

Certainly - there are several ways of hiding from the task manager. The simplest is to hide in plain sight with the process named something innocuous. Another option is to hide as a sub-process which then doesn't show up.

It could also install as a service, again with an innocent name. It would show in the list of services but wouldn't be shown separately in the task list. There will, I'm sure be other, more complex methods that a Google search would show up.

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged .