[r3shl4k1sh]

Does anybody knows about a tool that can list the processes currently running on a system through the kernel (so that it can detect the usual DKOM attacks) and give me the results on the CLI ?

I want to use the tool in my script hence i need the CLI.

Thanks.

[EP_X0FF]

Procwalker, csrwalker

all x86

http://www.kernelmode.info/forum/viewto ... ?f=11&t=10

csrwalker will do this from user mode, but it will detect every process hider up to date

not work with w8 and maybe 7, i don't remember

also see xuetr, it has cli version