Native API
0001-01-01
The Native API is an API used by Windows NT and user mode applications.
Most of the native API calls are implemented in ntoskrnl.exe and exposed to user mode via ntdll.dll
The entry point of ntdll.dll is LdrInitializeThunk
Native API calls are handled b the kernel via the System Service Descriptor Table (SSDT)
https://en.wikipedia.org/wiki/Windows_Native_API
Linux Persistence: Modular Software
2025-04-17 DFIR CTF persistence linux persistence apache asterisk
Linux Persistence: Web Shells
2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP
Linux Persistence: Rootkits
2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking
Defanging Linux LKM Rootkits With cleanup_module()
2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit