Hello guys
so i have managed to hook the task manager every time it starts automatically by hooking explorer.exe and its createprocess API
the problem i realized is that when someone uses cntrl+alt+delete, the parent of it changes
in windows 7 its winlogon and its SYSTEM so i assume there is no way to hook it even with a run as admin app (if there is please let me know)
and in windows 10 i cant even find the parent of task manager when its created using cntrl alt delete since it dies fast and it doesnt show the name, doesnt look like its winlogon tho (again if anyone knows anything useful let me know)
so is there actually any way to hook the parent of task manager when its not created via explorer and its created via cntrl alt delete so i can hook its createprocess function and find out when task manager is loaded?
i assume one way to solve it is to keep looking for task manager in my user level rootkit but i think that would be both inefficient and suspicious for AVs
so i have managed to hook the task manager every time it starts automatically by hooking explorer.exe and its createprocess API
the problem i realized is that when someone uses cntrl+alt+delete, the parent of it changes
in windows 7 its winlogon and its SYSTEM so i assume there is no way to hook it even with a run as admin app (if there is please let me know)
and in windows 10 i cant even find the parent of task manager when its created using cntrl alt delete since it dies fast and it doesnt show the name, doesnt look like its winlogon tho (again if anyone knows anything useful let me know)
so is there actually any way to hook the parent of task manager when its not created via explorer and its created via cntrl alt delete so i can hook its createprocess function and find out when task manager is loaded?
i assume one way to solve it is to keep looking for task manager in my user level rootkit but i think that would be both inefficient and suspicious for AVs