Blog | G5 Cyber Security

AltFS Fileless File System Aims to Evade Detection by Security Software

Researchers from SafeBreach have developed an open source library that creates a fileless file system that resides solely in operating system resources such as the Windows Registry, WMI, or the user defaults system in MacOS. Researchers have also created a template for researchers to create their own storage providers using other OS resources. When a file is stored in AltFS, it will be broken up into multiple blocks of data that are stored in the registry as a REG_BINARY value. The library is meant to be public and completely open-source, to allow researchers to demonstrate it and verify defense tools using it.

Source: https://www.bleepingcomputer.com/news/security/altfs-fileless-file-system-aims-to-evade-detection-by-security-software/

Exit mobile version