Windows Kernel: DKOM

Direct Kernel Object Manipulation — don't hook code, edit the

data the OS trusts.

• The kernel tracks live processes in a doubly linked list of EPROCESS blocks (ActiveProcessLinks).
• To hide a process, unlink its EPROCESS: point the previous node's Flink and the next node's Blink around it.
• The thread scheduler still runs the process (it schedules threads, not the list), so the malware keeps running while Task Manager, which walks the list, cannot see it.