Detecting Running Process: EnumProcess API
Created the Monday 18 March 2019. Updated 1 year, 1 month ago.
Anti-monitoring is a technique used by malware to prevent security professionals from detecting and analyzing it. One way that malware can accomplish this is by using the EnumProcess
function to search for specific processes, such as ollydbg.exe or wireshark.exe, which are commonly used by security professionals to monitor and analyze running processes on a system.
By detecting these processes and taking evasive action, such as terminating itself or encrypting its own code, malware can prevent security professionals from gaining visibility into its activities and disrupt their efforts to analyze it.
Technique Tags
EnumProcess function Ollydbg.exe Wireshark.exe Monitoring Analysis
Featured Windows API's
Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.
Code Snippets
Detection Rules
Additional Resources
External Links
The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
1445a6fae415ff8b97807309ed6d...29636ba6a100dbcf3e3e04924790 | 7 | 2024-11-19 | 1 week, 6 days ago |
0f52170adf871c6983d7aaa2162a...7b5850a294feaa71dcaffcf661a2 | 12 | 2024-11-19 | 1 week, 6 days ago |
al-khaser.exe | 24 | 2024-11-13 | 2 weeks, 4 days ago |