DKOM is one of the most common techniques used by rootkits for hiding malicious user-mode processes. This technique relies on how the OS represents processes and threads. In order to understand this technique, you need to learn more about the objects that are being manipulated by the rootkit: EPROCESS and ETHREAD.
DKOM
The kernel objects—EPROCESS and ETHREAD
Windows creates an object called EPROCESS for each process that's created in the system. This object includes all the important information about this process, such as Virtual Address Descriptors (VADs), which stores the map of this process's virtual memory and its representation in physical memory. It also includes the process ID, the parent process ID, and a...
