The purpose of this study is to evaluate the possibility of implementing an attack on ALPC connection in the Windows operating system through the kernel without closing the connection covertly from programs and the operating system and to propose a method of protection against this type of attacks. Asynchronous Local Procedure Call technology (ALPC) is used in various Windows information protection systems, including antivirus systems (AV) and Endpoint Detection and Response systems (EDR). To ensure the concealment of malicious software, attackers need to disrupt the operation of AV, EDR tools, which in turn can be achieved by destructive impact on the components of the ALPC technology. Examples of such attacks already exist and are covered in this paper. To counteract such new threats, it is necessary to advance the improvement of information security systems and the ALPC security research was conducted. The most difficult case, Windows kernel driver attack, was considered. Three attacks on the ALPC connection were carried out, based on changing the ALPC structures in the kernel memory, which led to creation of illegitimate connections in the system and the disruption of correct connections. ALPChecker protection tool has been developed. The tool was successfully tested on three demonstrated attacks.

翻译：本研究旨在评估通过内核在Windows操作系统中对ALPC连接实施攻击的可能性，且在不被程序与操作系统察觉的情况下隐蔽关闭连接，并提出针对此类攻击的防护方法。异步本地过程调用技术（ALPC）被广泛应用于Windows信息保护系统，包括防病毒系统（AV）和端点检测与响应系统（EDR）。为隐藏恶意软件，攻击者需要破坏AV与EDR工具的运作，这可通过对ALPC技术组件的破坏性攻击实现。本文已涵盖并分析了此类攻击的现有案例。为应对此类新型威胁，需推进信息安全系统的改进，并开展了ALPC安全性研究。其中重点分析了Windows内核驱动攻击这一最复杂的情况。通过修改内核内存中的ALPC结构，实施了三种针对ALPC连接的攻击，导致系统中产生非法连接并破坏正确连接。本文开发了ALPChecker防护工具，该工具已在三种演示攻击中成功通过测试。