Detection: Memory Forensics and Hardening

• Memory forensics (Volatility): dump RAM and analyze it offline — pslist (list walk) vs psscan (pool tag scan) reveals DKOM-hidden processes; ssdt, modules vs modscan expose hooks and unlinked drivers.
• Driver Signature Enforcement (DSE): 64-bit Windows refuses unsigned kernel drivers — the hurdle Stuxnet dodged with stolen certs.
• PatchGuard / Kernel Patch Protection: on x64 Windows, periodically checks core structures (SSDT, IDT, key code) and bugchecks if patched — killing classic SSDT hooking.
• Secure Boot + TPM measured boot: verify firmware and boot loader signatures to stop bootkits/UEFI implants.