Category Archives: Windows
Asynchronous Analysis of Windows KPRCBs for Detection of Unsigned Kernel Shellcode Execution

Introduction What This Post Covers In this article, we’ll explore: The goal is to provide a practical framework for engineers who need to reason about what processors are doing at runtime and ensure that all kernel instructions can be traced back to trusted, signed system images. What is “Unsigned Kernel Shellcode”? In recent years, it’s…