WEBVTT

00:00:01.040 --> 00:00:03.860
Let's take a closer look at kernel‑mode drivers.

00:00:04.340 --> 00:00:06.350
When a kernel‑mode driver is started,

00:00:06.840 --> 00:00:11.960
it can call a series of APIs exposed by the kernel to install callback routines.

00:00:12.540 --> 00:00:15.530
This will inform the kernel that when a specific event occurs,

00:00:15.540 --> 00:00:18.610
it needs to send relevant information to the driver by

00:00:18.610 --> 00:00:20.760
calling the function which was registered.

00:00:21.440 --> 00:00:24.610
Callbacks can be registered for various types of events,

00:00:24.790 --> 00:00:28.160
such as process operations, module load operations,

00:00:28.390 --> 00:00:31.910
thread operations, handle operations, and, finally,

00:00:31.920 --> 00:00:33.260
registry operations.

00:00:33.840 --> 00:00:38.220
Since these callbacks occur in the kernel, they can be used to reject a

00:00:38.220 --> 00:00:41.980
given operation, or they might trigger additional activity,

00:00:42.040 --> 00:00:45.950
such as injecting an API monitoring DLL into newly created

00:00:45.950 --> 00:00:49.770
processes or preventing handle operation on sensitive

00:00:49.770 --> 00:00:52.550
processes, such as the antivirus itself.

00:00:52.940 --> 00:00:53.270
Next,

00:00:53.270 --> 00:00:56.870
we have filter drivers, which can provide insight into file

00:00:56.870 --> 00:01:00.260
system activity and can be used to scan files for malicious

00:01:00.260 --> 00:01:02.520
content when they're being written to disk.

00:01:02.710 --> 00:01:05.980
They can also be used to protect the antivirus by rejecting

00:01:05.980 --> 00:01:09.400
operations, which attempt to delete critical files, which are

00:01:09.400 --> 00:01:12.350
required for the antivirus or EDR to run.

00:01:12.840 --> 00:01:14.660
Finally, we have network drivers.

00:01:15.040 --> 00:01:18.070
They can be used to collect data regarding network activity,

00:01:18.080 --> 00:01:19.590
such as the IP addresses,

00:01:19.590 --> 00:01:23.760
ports, and host names which were observed during network communications.

00:01:24.540 --> 00:01:27.150
Let's take a closer look at callback routines.

00:01:27.640 --> 00:01:31.460
I have written a simple driver, which will register a callback, which

00:01:31.460 --> 00:01:37.270
relate to process activities using the PsSetCreateProcessNotifyRoutineEx

00:01:37.270 --> 00:01:42.740
function. When this function is called, the kernel will register the

00:01:42.740 --> 00:01:47.660
drivers function and ensure that any time a process is created or deleted,

00:01:47.660 --> 00:01:53.380
the function in the driver gets called. When called, the kernel will pass

00:01:53.380 --> 00:01:58.170
various parameters to the function, which we can use to send information

00:01:58.180 --> 00:01:58.740
to a debugger.

00:02:00.740 --> 00:02:02.660
We can go ahead and start the driver.

00:02:03.240 --> 00:02:05.240
If I run notepad.exe,

00:02:05.250 --> 00:02:09.440
you will notice that the process creation was logged by the driver, and the

00:02:09.440 --> 00:02:15.150
message was sent to the debugger. An antivirus or EDR could make use of

00:02:15.150 --> 00:02:20.000
this callback to block a process from being created or to gain insight into

00:02:20.000 --> 00:02:22.350
processes which are being created.

00:02:23.140 --> 00:02:27.160
Here is a graphical representation of what the callbacks look like.

00:02:28.440 --> 00:02:31.130
If the kernel spins up a new Notepad process,

00:02:31.240 --> 00:02:34.880
it will call the function, which relates to process creations,

00:02:34.890 --> 00:02:37.260
which was installed by the antivirus driver.

00:02:37.640 --> 00:02:41.560
Information regarding the process creation is passed to the driver,

00:02:41.570 --> 00:02:44.750
which can send the information to the antivirus service.

00:02:45.640 --> 00:02:48.960
At this point, the antivirus can perform additional activities,

00:02:48.970 --> 00:02:51.160
as we will discover later on in the course.