{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,8]],"date-time":"2024-09-08T06:59:27Z","timestamp":1725778767003},"reference-count":30,"publisher":"IEEE","license":[{"start":{"date-parts":[[2024,5,16]],"date-time":"2024-05-16T00:00:00Z","timestamp":1715817600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,5,16]],"date-time":"2024-05-16T00:00:00Z","timestamp":1715817600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024,5,16]]},"DOI":"10.1109\/aqtr61889.2024.10554183","type":"proceedings-article","created":{"date-parts":[[2024,6,14]],"date-time":"2024-06-14T17:31:09Z","timestamp":1718386269000},"page":"1-6","source":"Crossref","is-referenced-by-count":0,"title":["Monitoring of RPC Messages with ALPC-Level API Hooking"],"prefix":"10.1109","author":[{"given":"Muntea","family":"Andrei-Marius","sequence":"first","affiliation":[{"name":"Technical University of Cluj-Napoca, Bitdefender,Cluj-Napoca,Romania"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Portase","family":"Radu-Marian","sequence":"additional","affiliation":[{"name":"Technical University of Cluj-Napoca, Bitdefender,Cluj-Napoca,Romania"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sebestyen-Pal","family":"Gheorghe","sequence":"additional","affiliation":[{"name":"Technical University of Cluj-Napoca,Cluj-Napoca,Romania"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(16)30008-3"},{"key":"ref2","first-page":"267","volume-title":"Code Injection, Process Hollowing, and API Hooking","author":"Abhijit","year":"2020"},{"volume-title":"Microsoft RPC Programming Guide","year":"1995","author":"Shirley","key":"ref3"},{"volume-title":"Learning DCOM","year":"1999","author":"Thai","key":"ref4"},{"volume-title":"Threat landscape for windows management instrumentation (wmi): A 10-year study-whitepaper bitdefender labs","year":"2021","author":"Bitdefender","key":"ref5"},{"volume-title":"Windows System Programming","year":"2010","author":"Hart","key":"ref6"},{"volume-title":"Windows Internals Seventh Edition Part 1","year":"2017","author":"Yosifovich","key":"ref7"},{"volume-title":"Microsoft Remote Procedure Call (RPC)-technology for creating distributed client\/server programs","key":"ref8"},{"volume-title":"Transfer Syntax NDR-documentation and online resource","key":"ref9"},{"article-title":"All about the ALPC, RPC, LPC, LRPC in your PC","volume-title":"SyScan Conference","author":"Ionescu","key":"ref10"},{"volume-title":"Windows RPC Clients open source project","key":"ref11"},{"article-title":"A view into ALPC-RPC","volume-title":"PacSec Conference","author":"Rouault","key":"ref12"},{"volume-title":"ALPC Logger","key":"ref13"},{"volume-title":"Event Tracing for Windows (ETW) Specification","key":"ref14"},{"volume-title":"Universal tracing of side-channel processes in computing environments","year":"2022","author":"Naamneh","key":"ref15"},{"volume-title":"Detecting malware by linking background intelligent transfer service (bits) and scheduled task service (sts) activities to a source program","year":"2023","author":"Stanciu","key":"ref16"},{"volume-title":"Rpcview open source tool","author":"Borello","key":"ref17"},{"volume-title":"MS-SAMR: Security Account Manager (SAM) Remote Protocol (Client-to-Server)","year":"2023","key":"ref18"},{"volume-title":"MS-SCMR: Service Control Manager Remote Protocol","year":"2023","key":"ref19"},{"volume-title":"MS-FASP: Firewall and Advanced Security Protocol","year":"2023","key":"ref20"},{"volume-title":"MS-LSAD: Local Security Authority (Domain Policy) Remote Protocol","year":"2023","key":"ref21"},{"volume-title":"MS-TSCH: Task Scheduler Service Remote Protocol","year":"2023","key":"ref22"},{"volume-title":"MS-EVEN: EventLog Remoting Protocol","year":"2023","key":"ref23"},{"journal-title":"Stride-mnemonic for grouping security threats","key":"ref24"},{"volume-title":"Windows alpc elevation of privilege vulnerability using task scheduler endpoint","key":"ref25"},{"journal-title":"Malshare-free access to malware samples and tooling to the information security","key":"ref26"},{"journal-title":"Malpedia-service that allows rapid identification and actionable context when investigating malware","key":"ref27"},{"journal-title":"Virustotal-service that allows you to scan files, domains, ips and urls for malware and other threats, and share them with the security community","key":"ref28"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ISPDC52870.2021.9521600"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427261"}],"event":{"name":"2024 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR)","start":{"date-parts":[[2024,5,16]]},"location":"Cluj-Napoca, Romania","end":{"date-parts":[[2024,5,18]]}},"container-title":["2024 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10554066\/10554069\/10554183.pdf?arnumber=10554183","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,25]],"date-time":"2024-06-25T19:14:09Z","timestamp":1719342849000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10554183\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,16]]},"references-count":30,"URL":"https:\/\/doi.org\/10.1109\/aqtr61889.2024.10554183","relation":{},"subject":[],"published":{"date-parts":[[2024,5,16]]}}}