What about PsSetLoadImageNotifyRoutine ? about herpaderping

[jxy-s]

Indeed, those are good indicators that something wonky is happening 😄. That said, you might observe false positives on those indicators alone.

Yes, the same can be observed in both image load and process create. There are challenges with respect to preforming inspection during the image load notify routine. Security software has tended to avoid that path due to these challenges. Although it is possible to do so with some careful handling and some security software does. The state of the thread/process is in when the callback is invoked has changed over the years. And for which images it is invoked has also changed. More info in the remarks section of the MSDN documentation. And see SEC_IMAGE_NO_EXECUTE. There is also no trivial/documented way to deny the image load from occurring in that path. In contrast, the process notify routine does expose a documented way to deny process creation. For these reasons most defensive techniques against this type of evasion occurs during inspection at the process creation routine. I'll also add there are some mini-filter callbacks for doing inspection during section creation but struggle with similar caveats/drawbacks as the image load notification (see: IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION).

I also recommend giving this blog post from Microsoft a read. They outline a few indicators that I was unfamiliar with during my initial research.

[d-cheholia]

Thank you!