https://x7peeps.com/tags/Windows%E5%86%85%E6%A0%B8/index.htmlHugozh-CNMon, 13 Jul 2026 11:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/Windows%E5%86%85%E6%A0%B8%E5%9B%9E%E8%B0%83%E4%B8%8EDKOM%E6%A3%80%E6%B5%8B%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.htmlMon, 13 Jul 2026 11:00:00 +0800https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/0x03%E5%8F%96%E8%AF%81%E5%88%86%E6%9E%90/Windows%E5%86%85%E6%A0%B8%E5%9B%9E%E8%B0%83%E4%B8%8EDKOM%E6%A3%80%E6%B5%8B%E5%8F%96%E8%AF%81%E6%B7%B1%E5%BA%A6%E5%88%86%E6%9E%90/index.html深度剖析Windows内核回调机制与DKOM攻击取证检测方法，涵盖PsSetCreateProcessNotifyRoutine等内核通知例程枚举、DKOM链表篡改检测、驱动签名策略绕过取证、Minifilter微过滤驱动分析、内核对象完整性验证，结合Turla与Equation Group Rootkit案例还原内核级攻击链