Kernel Games: The Ballad of Offense and Defense in Rootkit Methodologies

Watch a 31-minute conference talk from x33fcon exploring the intricate world of kernel-level rootkit development and detection strategies. Dive into advanced rootkit methodologies including DLL injection concealment, credential dumping from kernel space, and AV/EDR kernel callback removal. Follow along with practical demonstrations integrating Mythic C2's Athena agent in red team scenarios. Learn defensive techniques for detecting rootkit activities like callback removal, file protection mechanisms, and ETWTI tampering. Examine a custom tool demonstration that provides defenders enhanced visibility into loaded kernel drivers, their registered callbacks, imports, and IRP hooks through detailed code examples and live demos.