rootkit.

malware analysis

Nanga: Process Telemetry from the Syscall Layer

A kernel-driver approach to malware dynamic analysis that captures process telemetry below user-mode evasion, at the syscall layer.