Knowledge Hub

S.T.A.R — Building a Cross-Platform Kernel-Level Threat Radar

Engineering articleBy Naveed Sohail Gung2025-11-20SecurityCKernelElectron

A deep dive into S.T.A.R (System Threat & Anomaly Radar), a C-based threat detection engine that hooks into Windows WDM and Linux kernel to catch rootkits and memory anomalies in real time.

Article summary

A deep dive into S.T.A.R (System Threat & Anomaly Radar), a C-based threat detection engine that hooks into Windows WDM and Linux kernel to catch rootkits and memory anomalies in real time.

What this article covers

The Problem with Userspace Detection Most endpoint security tools run in userspace. They hook into libraries, intercept API calls, and monitor process creation events through documented interfaces. This works well for commodity malware — but sophisticated rootkits operate below them.

What this article covers (2)

A kernel-level rootkit can patch system call tables (SSDT hooking), hide processes by unlinking them from the scheduler's doubly-linked list (Direct Kernel Object Manipulation), intercept disk I/O to hide files, and modify network stack data structures to conceal connections. All of this is invisible to userspace tools.

What this article covers (3)

S.T.A.R was born from a simple question: what if the detector lived at the same privilege level as the attacker?

Topics and technologies

  • Security
    Browse related articles in the knowledge hub.
  • C
    Browse related articles in the knowledge hub.
  • Kernel
    Browse related articles in the knowledge hub.
  • Electron
    Browse related articles in the knowledge hub.
  • WebGL
    Browse related articles in the knowledge hub.

Related navigation