1

On Windows, how would one go about hiding procmon from another process? What techniques/terms would I be searching for?

Improve this question
0

2 Answers 2

Reset to default
3

You have to write a rootkit for this purpose. Look at this two.

https://github.com/landhb/HideProcess

https://www.codeproject.com/Articles/167583/Driver-to-Hide-Processes-and-Files-Second-Edition

Improve this answer
5
  • Wlc. You can also do patching. It depends on your case.
    – EWD-0-
    Oct 26, 2017 at 14:56
  • Could you elaborate on patching? This is all new to me.
    – user737447
    Oct 28, 2017 at 6:45
  • Please explain for what you need to hide this particular process. Then I can give more details
    – EWD-0-
    Oct 28, 2017 at 8:54
  • I believe I just need to hide the process name. Does 'patching' mean custom kernel with modified list process call?
    – user737447
    Oct 29, 2017 at 0:07
  • No. You've not explained the case in detail yet and without that information, it's' not possible to say which method is the best choice for you.
    – EWD-0-
    Oct 30, 2017 at 10:49
0

If you are trying to hide Procmon from another process, and you control the environment, say in an analysis lab, it may be sufficient just to hook the victim processes methods for obtaining a process list and feed it an incomplete process list.

Another way to do it would be to hexedit the method that looks for procmon such that it always returns false.

The rootkit idea above works too, but it might be overkill depending on your situation.

Improve this answer
2
  • What's used to create the hook? Hexedit the method?
    – user737447
    Oct 28, 2017 at 6:45
  • You need a hooking framework. frida.re/docs/functions works. Depending on your version of Windows, you may have to play with your settings for it to work.
    – MrSynAckSter
    Oct 30, 2017 at 17:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.