  The purpose of this study is to evaluate the possibility of implementing an
attack on ALPC connection in the Windows operating system through the kernel
without closing the connection covertly from programs and the operating system
and to propose a method of protection against this type of attacks.
Asynchronous Local Procedure Call technology (ALPC) is used in various Windows
information protection systems, including antivirus systems (AV) and Endpoint
Detection and Response systems (EDR). To ensure the concealment of malicious
software, attackers need to disrupt the operation of AV, EDR tools, which in
turn can be achieved by destructive impact on the components of the ALPC
technology. Examples of such attacks already exist and are covered in this
paper. To counteract such new threats, it is necessary to advance the
improvement of information security systems and the ALPC security research was
conducted. The most difficult case, Windows kernel driver attack, was
considered. Three attacks on the ALPC connection were carried out, based on
changing the ALPC structures in the kernel memory, which led to creation of
illegitimate connections in the system and the disruption of correct
connections. ALPChecker protection tool has been developed. The tool was
successfully tested on three demonstrated attacks.
