SANS Handler Review

Helios got mentioned by SANS handler Lenny Zeltser in todays Handlers Diaries. His ideas about using rootkit detection for incident handling are in line with a set of features that we plan to roll out (stuff like offline analysis with live-cds etc). You can read the diary entry here.

At MIEL Labs we're big followers of the SANS handlers diaries and would like to commend them on keeping us all up to date on the state of the 'Net.

The review mentions incorrectly that Helios does not detect the FuTo rootkit. The reason it was not detected in their tests was that the 'Advanced Detection' thread level detection feature was not enabled. When this feature is enabled, the second a hidden process gets CPU time, it will be detected. This can be seen in any of the FuTo videos on our videos page.

Look for a new version with more features based on community feedback very soon. We'll post here when it is updated.