Monitoring of RPC Messages with ALPC-Level API Hooking

In an attempt to remain undetectable, malicious programs try to use legitimate code calls in order to penetrate a computer system. In this research paper, we present a threat model centred around RPC (Remote Procedure Call) communication utilizing ALPC (Advanced Local Procedure Call) and propose a method for evaluating and testing detection techniques under these conditions. Additionally, our research presents a monitoring approach that is effective for both documented and undocumented interfaces, thereby improving the identification and comprehension of cyber threats.