Skip to content
Threat Feed
Subscribe

Tag

Process-Monitoring

3 briefs RSS
medium advisory

Command Line Obfuscation via Whitespace Padding

Detection of command-line obfuscation where attackers insert excessive whitespace sequences to evade signature-based security monitoring tools.

defense-evasion obfuscation process-monitoring
1r 2t
medium advisory

macOS Kernel-to-Userland Process Creation Notification via undocumented kev_msg_post

The kev_msg_post function can be abused by malware to broadcast process creation notifications from a kernel extension (kext) to a user-mode application, potentially bypassing security tools that rely on standard APIs and leading to undetected malicious activity.

BlockBlock kernel-extension kev_msg_post macos process-monitoring
2r
medium advisory

Leveraging Apple's Endpoint Security Framework for Process Monitoring

This brief discusses the use of Apple's Endpoint Security Framework in macOS 10.15 and later for user-mode process monitoring, offering improved capabilities over the older OpenBSM subsystem.

macOS endpoint-security process-monitoring defense-evasion discovery
2r 2t