Which technique enumerates key elements in the computer system such as system files, processes, and registry keys and compares them to a baseline dataset that is generated without relying on common APIs, with discrepancies indicating rootkit presence?

Which technique enumerates key elements in the computer system such as system files, processes, and registry keys and compares them to a baseline dataset that is generated without relying on common APIs, with discrepancies indicating rootkit presence?

• A. Cross View-Based Detection
• B. Alternative Trusted Medium
• C. Runtime Execution Path Profiling
• D. GMER

Answer: (C)

Two independent views of the system are used to reveal hidden components. In this approach, you enumerate key elements like system files, running processes, and registry keys, but you do it twice: once through standard APIs (which rootkits may manipulate) and once without relying on those APIs, using a baseline dataset generated in a trusted, non-API manner. By comparing the two views, any discrepancies indicate items that are present in one view but hidden in the other, which points to a rootkit. This technique is known as cross view-based detection. It relies on the fact that rootkits can tamper with API responses, so using an alternative method that doesn’t depend on those APIs exposes the hidden elements. Runtime Execution Path Profiling, by contrast, focuses on how code executes and the control flow during runtime rather than comparing system inventories against a non-API baseline. GMER is a tool that can implement this kind of detection, but the underlying concept described is cross view-based detection.

Two independent views of the system are used to reveal hidden components. In this approach, you enumerate key elements like system files, running processes, and registry keys, but you do it twice: once through standard APIs (which rootkits may manipulate) and once without relying on those APIs, using a baseline dataset generated in a trusted, non-API manner. By comparing the two views, any discrepancies indicate items that are present in one view but hidden in the other, which points to a rootkit.

This technique is known as cross view-based detection. It relies on the fact that rootkits can tamper with API responses, so using an alternative method that doesn’t depend on those APIs exposes the hidden elements. Runtime Execution Path Profiling, by contrast, focuses on how code executes and the control flow during runtime rather than comparing system inventories against a non-API baseline. GMER is a tool that can implement this kind of detection, but the underlying concept described is cross view-based detection.