Rootkit Detection & Memory Forensics → Hypervisor Detection → Hypervisor-based Kernel Protection → Attacks on Telemetry → Desktop Protection.
| Period | Research direction and key result | Key materials |
|---|---|---|
| 2009–2015 | Memory Forensics for Rootkit Detection Detection of kernel-mode rootkits and hidden OS structures through memory dump analysis |
Applying Memory Forensics to Rootkit Detection |
| 2010–2014 | Stealthy Hypervisor Detection Detection of hidden hypervisors under compromised timing counters (time cheating) and unstable timing measurements |
• PhD dissertation (Russian): «Методика обнаружения нелегитимного программного обеспечения, использующего технологию аппаратной виртуализации» • Two Challenges of Stealthy Hypervisors Detection: Time Cheating and Data Fluctuations |
| 2016–2022 | MemoryRanger — Hypervisor-based Kernel Protection Development of hypervisor-based OS protection mechanisms using Intel VT-x/EPT: HyperPlatform, running drivers in isolated memory enclaves, and research into new attacks on Windows kernel objects |
• GitHub • Black Hat Europe 2018 |
| 2019–2022 | Security Telemetry Under Attack Development and analysis of new attacks on ETW/WMI to blind EDR/SIEM systems and research into improving the resilience of security monitoring |
• Black Hat Europe 2021 — ETW • Black Hat USA 2022 — WMI • Microsoft Defender Will Be Defended: MemoryRanger Prevents Blinding Windows AV |
| 2025–2026 | DesktopRanger — Windows Desktop Isolation Hardening Windows Desktop isolation and protecting user input |
• GitHub • OFFZONE 2026 |
A complete chronology of earlier publications, talks, and research projects is available in the research archive.
A systematic treatment of research on OS kernel protection, memory, drivers, and techniques for detecting hidden code under active adversarial countermeasures.
| Year | Publication | Publisher |
|---|---|---|
| 2026 | Защита ядра операционных систем в условиях противодействия Kernel Protection of Operating Systems Under Countermeasures |
INFRA-M |