More Info Needed In Process Enumeration

[shakuni]

There is this tool that fetches the list of all the running processes and then flags all those processes that are dangerous. Now getting the list of all the running processes is trivial and has been discussed on the forums infinite times. What I ask is how does the tool decides wheather a process is dangerous or not. My first thought was that this tool monitors all the api calls of all the processes and then based on that info it determines the dangerous processes but this can’t be true since system processes uses almost same apis that are used by dangerous processes (like accessing registries and files on disk etc.). Any ideas? (otherwise I would have to reverse the program myself to find out how it does that)

[Vadim Smirnov]

Probably you are right and the mentioned tool monitors the process behavior and imported/used Win32 API. An example, not every normal process uses CreateRemoteThread.

[Author]

Posts