Let's take a closer look at kernel‑mode drivers.
When a kernel‑mode driver is started,
it can call a series of APIs exposed by the kernel to install callback routines.
This will inform the kernel that when a specific event occurs,
it needs to send relevant information to the driver by
calling the function which was registered.
Callbacks can be registered for various types of events,
such as process operations, module load operations,
thread operations, handle operations, and, finally,
registry operations.
Since these callbacks occur in the kernel, they can be used to reject a
given operation, or they might trigger additional activity,
such as injecting an API monitoring DLL into newly created
processes or preventing handle operation on sensitive
processes, such as the antivirus itself.
Next,
we have filter drivers, which can provide insight into file
system activity and can be used to scan files for malicious
content when they're being written to disk.
They can also be used to protect the antivirus by rejecting
operations, which attempt to delete critical files, which are
required for the antivirus or EDR to run.
Finally, we have network drivers.
They can be used to collect data regarding network activity,
such as the IP addresses,
ports, and host names which were observed during network communications.
Let's take a closer look at callback routines.
I have written a simple driver, which will register a callback, which
relate to process activities using the PsSetCreateProcessNotifyRoutineEx
function. When this function is called, the kernel will register the
drivers function and ensure that any time a process is created or deleted,
the function in the driver gets called. When called, the kernel will pass
various parameters to the function, which we can use to send information
to a debugger.
We can go ahead and start the driver.
If I run notepad.exe,
you will notice that the process creation was logged by the driver, and the
message was sent to the debugger. An antivirus or EDR could make use of
this callback to block a process from being created or to gain insight into
processes which are being created.
Here is a graphical representation of what the callbacks look like.
If the kernel spins up a new Notepad process,
it will call the function, which relates to process creations,
which was installed by the antivirus driver.
Information regarding the process creation is passed to the driver,
which can send the information to the antivirus service.
At this point, the antivirus can perform additional activities,
as we will discover later on in the course.