From 998e9dec953fd5b59e4290ca4e9bd0744b4535ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=B5=D0=B2=D0=B5=D1=80=D1=81=D0=B8=D0=BD=D1=8633?= <51821028+eversinc33@users.noreply.github.com> Date: Sat, 23 Mar 2024 15:55:03 +0100 Subject: [PATCH] Update README.md --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 529cd4f..5610b7c 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,8 @@ A PoC anti-rootkit that can detect drivers mapped to kernel memory. Think [Moneta](https://github.com/forrest-orr/moneta), but for the kernel (obviously this is a simplified comparison). +Blog post available at: https://eversinc33.com/posts/anti-anti-rootkit-part-i/ + The idea is to have a small & concise anti-rootkit to aid you (the rootkit dev) in honing your rootkits evasion abilities while also showcasing detection vectors with minimal FP rate that can detect many of the openly available driver mapper + rootkit combinations. While some open source anti-cheats with capabilities far beyond this tool's exist (such as donnaskiez [ac](https://github.com/donnaskiez/ac)), I wanted something that I can easily tweak according to my needs. Maybe it will be useful for you too.