GhostHook - Windows 10 Rootkit Technique

Malware using this technique can execute code in the kernel and remain completely undetected. PatchGuard was developed with the aim of preventing users from being able to patch the kernel and in turn, preventing rootkit installation at the kernel level. Along with memory protections built into Windows 10 , the effectiveness has been evident with no rootkits seen to date able to bypass these protections. Researchers behind the GhostHook project claim they may have discovered a technique that brings attackers one step closer to bringing rootkits to Windows 10.

The technique allows exploitation of Microsoft's implementation of the Intel PT API, a function released to allow security vendors to hook into PatchGuard and ultimately monitor commands executed in the CPU allowing attacks to be discovered before reaching the operating system.

GhostHook allows code executed in the kernel to go completely unnoticed by security products that rely on Intel PT by bypassing the protection put in place.

With access to the GhostHook technique, an attacker could use it to hook a rootkit directly into the kernel that could gain persistence and continue operating indefinitely, unnoticed by anti-malware, firewalls and host-based intrusion detection systems.

Microsoft have stated they will not be publishing a patch for GhostHook as it is not seen as a intrusion or privilege escalation vulnerability. Instead, to be able to write to the kernel as needed by the technique, an attacker would need to have already gained administrator privileges on the target device and hence Microsoft would deem to the system already compromised at this stage.