Hypervisor Defences Against Modern Evasion Techniques

Modern hardware allows for higher permissions privileges than the operating system or the supervisor. These new privilege levels enable modern hypervisor-based forensics and provide a new level of security against malware. The evasive technologies of yesterday, such as file-less approaches and self-modifying code, were no longer efficient. We surveyed modern hypervisor forensics software and various modern viruses and the antivirus evasion techniques they use. We explore how they can be countered by the hypervisor.