## 5 What Could Have Been Done?
### Freely Available Rootkit Detection Tools and Their Comparison
#### 5.3.5 Finding Hooks
This technique allows a malware to hide its suspicious files in the file system. Finally, by inserting a call-gate descriptor into the Global Descriptor Table (GDT), code with lower privileges (ring 3) can legally invoke kernel mode (ring 0) codes. In order to see how effectively the existing rootkit detector tools could have been used to detect members of the Stuxnet family, we collected 33 freely available tools and tested their capacity of discovering hidden processes and different types of hooks on a machine infected by either Duqu or Flame. Appendix 7 contains the complete list of tools that we used. (Note that we deliberately excluded the well-known malware forensics tool Volatility from the list, because it requires some user interaction and we are mainly interested in fully automated detection.) One interesting general result of our experiment is that the free anti-rootkit tools from known vendors such as McAfee, F-Secure, Microsoft, Kaspersky, TrendMicro, and Panda, show weak detection capabilities on the examined malware samples. However, there are other, not so well-known tools, notably XueTr [27], that proved to be very successful. Table 8 summarizes the effectiveness of the examined tools on revealing hidden processes/threads in the case of Duqu. As we can see, some of the tools do indeed discover the code injection in the lssss.exe process, however even the successful tools differ on the level of details that they provide. In particular, some tools just identify the hidden processes, while others also give back the name of the process in which they are injected, as well as their process or thread IDs. An interesting result of our experiment is that _none_ of the tools detected hidden processes or threads in case of Flame, although it does create a remote thread in services.exe, for example during the initial infection when the DDEnumCallback is called in mssecmgr.ocx. As we have seen in Section 5.2, one can even detect the existence of hidden threads in certain system processes using manual detection. The reason for this is that Flame uses a customized way of hiding itself, which apparently differs from known methods checked for by current tools. In Table 9, we report on the hook detection performance of the set of tools that we tested both in case of Duqu and Flame. As the table shows, several tools did identify the IAT and inline API hooks used by Duqu and Flame. However, there are again significant differences between their precision and the level of details that they provide to the user. We must highlight again that XueTr performed the best in hook detection, but GMBR and Rootkit Unhooker also provided detailed results. \begin{table}
\begin{tabular}{l l} \hline \hline
**Tool with hidden process detection capability** & **Results on Duqu** \\ \hline Bitdefender Rootkit Uncover (v1.0 Beta 2) & - \\ Catchme 0.3.1398 & - \\ CMC CodeWalker (2008) & - \\ Gmer (1.0.15.15641) & sort[RAND].nls in lsass.exe (PID: 1236) \\ IceSword v1.20 & - \\ Malwarebytes Anti-Malware 1.62.0.3000 & - \\ McAfee Rootkit Detective 1.0 & - \\ McAfee Rootkit Stinger 10.2.0.729 & - \\ NoVirusThanks Anti-Rootkit v1.2 (Free Edition) & - \\ Panda Antirootkit v1.07 & - \\ Respledence Sanity Check Home Edition v2.01 & - \\ RKDetector v2.0 Beta Security Analyser Tool & - \\ Rootkit Unhooker LE v3.7.300.509 & - \\ RootRepeal & - \\ Sophos Virus Removal Tool v2.1 & sort[RAND].nls in lsass.exe (PID: 1236) \\ SpyDllRemover & sort[RAND].nls (no process name) \\ Sysinternals RootkitRevealer & - \\ TrendMicro Rootkit Buster v5.0 2011 & sort[RAND].nls in lsass.exe (PID: 1236, 1176, 1048, 1416) \\ Usec Radix v1.0.0.13 & - \\ XueTr & sort[RAND].nls in lsass.exe (Reports Thread IDs) \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Detecting hidden processes/threads/modules with anti-rootkit tools.