S.T.A.R — Building a Cross-Platform Kernel-Level Threat Radar
A deep dive into S.T.A.R (System Threat & Anomaly Radar), a C-based threat detection engine that hooks into Windows WDM and Linux kernel to catch rootkits and memory anomalies in real time.
Article summary
A deep dive into S.T.A.R (System Threat & Anomaly Radar), a C-based threat detection engine that hooks into Windows WDM and Linux kernel to catch rootkits and memory anomalies in real time.
What this article covers
The Problem with Userspace Detection Most endpoint security tools run in userspace. They hook into libraries, intercept API calls, and monitor process creation events through documented interfaces. This works well for commodity malware — but sophisticated rootkits operate below them.
What this article covers (2)
A kernel-level rootkit can patch system call tables (SSDT hooking), hide processes by unlinking them from the scheduler's doubly-linked list (Direct Kernel Object Manipulation), intercept disk I/O to hide files, and modify network stack data structures to conceal connections. All of this is invisible to userspace tools.
What this article covers (3)
S.T.A.R was born from a simple question: what if the detector lived at the same privilege level as the attacker?
Topics and technologies
Related navigation
-
Browse all blog posts
Full engineering archive on the knowledge hub.
-
View delivery case studies
Architecture, implementation, and outcome breakdowns.