Implementing Anti-Virus Evasion: Process Ghosting Attack and Prevention

Studying how endpoint tools function to spot malicious activity can help find security holes that can be exploited during red team activities. The approach by altering the file that generates the process on a Windows machine, Process Herpaderping tries to execute evasion. The same outcomes may be obtained by deleting the file while the process is still being created. Organizations should regularly verify the characteristics of their product and develop other means of identification, even for the same strategy, even though certain endpoint solutions have matured over time and can detect sophisticated threats. In this paper, the authors have discussed about the process ghosting attack for the anti-virus evasion and the preventive measures used for the defense.