Nanga: Process Telemetry from the Syscall Layer
May 26, 202615 min read
A kernel-driver approach to malware dynamic analysis that captures process telemetry below user-mode evasion, at the syscall layer.
malware-analysiswindows-internalskernelsecurity-researchdynamic-analysisssdtrootkitreverse-engineering