Securing Linux and Windows Kernels against Runtime APTs
Invary delivers runtime integrity enforcement for both Windows and Linux platforms, adapting to the nature of each kernel.
APTs increasingly operate at runtime, exploiting memory and control flow. While Linux and Windows follow different design philosophies, they share the core responsibility of security.
These shared roles make both kernels attractive targets. But the way attackers exploit them, and the way defenders must respond, depends on platform specifics.
🐧 The Kernels 🪟
The Linux kernel is open source and instrumentable. Attackers and defenders alike can benefit from transparency. This fosters innovation, but also enables kernel-level attacks using legitimate mechanisms like eBPF or pointer redirection.
By contrast, the Windows kernel is proprietary and internally guarded. Microsoft’s architecture limits access to kernel internals through strict security boundaries. PatchGuard and Driver Signature Enforcement restrict runtime tampering. However, these controls are uneven in scope and assume an uncompromised boot.
Some Runtime Threat Vectors by Platform
Linux
- Symbol Abuse: Exposed kernel symbols enable attackers to locate and alter runtime structures.
- Inconsistent Enforcement: IMA and SELinux validate static integrity but do not enforce runtime consistency.
Windows
- Bootkits and Early Tampering: Attackers modify the kernel before PatchGuard initializes.
- Obfuscation: Attackers exploit gaps in PatchGuard’s coverage or trick its heuristics.
Invary's Approach
To deal with these on Windows, Invary uses protected memory read techniques to inspect sensitive kernel structures without interfering with PatchGuard. Invary operates with a model that emphasizes structure verification and memory integrity, identifying anomalies that suggest injection, redirection, or corruption; even if PatchGuard is unaware.
For Linux, Invary leverages the rich instrumentation available in the kernel to establish a clear picture of what the kernel should look like at runtime. It tolerates variability across distributions and kernel versions, ensuring accuracy; monitoring live memory to detect integrity violations.
Why Attackers Like APTs
APT actors increasingly choose runtime attacks because:
- They bypass file-based detection: Nothing is written to disk.
- They persist across patch cycles: Even updated systems remain compromised.
- They manipulate memory, not configuration: Post-boot enforcement is rare.
- They understand the limitations of IMA, PatchGuard, and traditional EDR.
Modern threats aren’t trying to break through the front door. They live inside trusted processes, abuse legitimate kernel functionality, and execute in memory regions that are assumed to be safe.
Invary's model understands platform-specific design. The result is visibility where traditional tools go blind. And enforcement where it matters most, when the system is live yet only assumed to be trusted.
