Detection Strategies for COM, WMI, and ALPC-Based Multi-Process Malware.

Area of Science:

• Computer Science
• Cybersecurity
• Software Engineering

Background:

• Behavioral malware detection relies on accurately attributing actions to processes.
• Malicious actors employ sophisticated techniques to obscure their activities, including process behavior spoofing.

Purpose of the Study:

• To investigate the use of Component Object Model (COM) and Windows Management Instrumentation (WMI) for process behavior spoofing attacks.
• To develop and evaluate robust monitoring techniques for detecting these spoofing methods.
• To analyze real-world malware utilizing COM, WMI, and Asynchronous Local Procedure Call (ALPC) for malicious purposes.

Main Methods:

• Detailed analysis of COM, WMI, and Asynchronous Local Procedure Call (ALPC) internals.
• Development and implementation of multiple functional process monitoring techniques.
• Creation of a robust process monitoring system designed to identify spoofed actions.
• Evaluation of monitoring techniques' strengths, weaknesses, and performance impact.

Main Results:

• Demonstrated the feasibility of COM and WMI for creating sophisticated process behavior spoofing attacks.
• Presented effective monitoring techniques capable of identifying spoofed malicious actions.
• Developed a low-performance-impact monitoring system that accurately identifies the source of spoofed actions.
• Examined real-world malware samples to understand practical exploitation of COM, WMI, and ALPC.

Conclusions:

• COM and WMI are viable tools for advanced malware to hide malicious activities by spoofing benign process behaviors.
• Effective monitoring systems are crucial for detecting and attributing actions in sophisticated spoofing attacks.
• Understanding the internals of COM, WMI, and ALPC is key to developing robust cybersecurity defenses against these threats.