Module 7: AV/EDR Scan Timing Window

Understanding exactly when antivirus and EDR products scan files during process creation — and why Process Ghosting bypasses all three inspection points.

1. The Three Inspection Points

AV and EDR products have three primary opportunities to scan a process’s backing executable. Each occurs at a different stage of the file → section → process pipeline:

2. Inspection Point 1: File I/O Minifilter

The file system minifilter is the first line of defense. AV products register minifilter drivers that intercept file I/O operations (IRPs). The relevant callbacks are:

Some AV minifilters can scan data from the write IRP buffer directly (without opening a separate handle). However, most on-access scanners are designed to scan on IRP_MJ_CLEANUP (handle close) and rely on being able to re-open the file for scanning. The delete-pending state defeats this model.

3. Inspection Point 2: Image Load Notification

The kernel provides PsSetLoadImageNotifyRoutine for drivers to register callbacks that fire when an image (EXE or DLL) is mapped into a process. This callback provides the image’s FILE_OBJECT and full image name:

// Kernel callback prototype
typedef VOID (*PLOAD_IMAGE_NOTIFY_ROUTINE)(
    PUNICODE_STRING FullImageName,
    HANDLE ProcessId,
    PIMAGE_INFO ImageInfo
);

// IMAGE_INFO structure
typedef struct _IMAGE_INFO {
    union {
        ULONG Properties;
        struct {
            ULONG ImageAddressingMode : 8;
            ULONG SystemModeImage : 1;
            ULONG ImageMappedToAllPids : 1;
            ULONG ExtendedInfoPresent : 1;
            // ...
        };
    };
    PVOID ImageBase;
    ULONG ImageSelector;
    SIZE_T ImageSize;
    ULONG ImageSectionNumber;
} IMAGE_INFO, *PIMAGE_INFO;

4. Inspection Point 3: Process Creation Notification

The most important inspection point is PsSetCreateProcessNotifyRoutineEx. Despite its name, this callback does not fire when the process object is created (NtCreateProcessEx). It fires when the first thread is inserted into the process via NtCreateThreadEx. This timing gap — between process object creation and first thread insertion — is exactly what Process Ghosting exploits. The file can be deleted after creating the process object but before the notify routine fires. The callback provides the AV driver with the information needed to make a scan/block decision:

// Extended process notification callback
typedef VOID (*PCREATE_PROCESS_NOTIFY_ROUTINE_EX)(
    PEPROCESS Process,
    HANDLE ProcessId,
    PPS_CREATE_NOTIFY_INFO CreateInfo  // NULL for process exit
);

// PS_CREATE_NOTIFY_INFO (on process creation)
typedef struct _PS_CREATE_NOTIFY_INFO {
    SIZE_T Size;
    union {
        ULONG Flags;
        struct {
            ULONG FileOpenNameAvailable : 1;
            ULONG IsSubsystemProcess : 1;
            // ...
        };
    };
    HANDLE ParentProcessId;
    CLIENT_ID CreatingThreadId;
    struct _FILE_OBJECT *FileObject;  // THE IMAGE FILE OBJECT
    PUNICODE_STRING ImageFileName;    // image file path
    PUNICODE_STRING CommandLine;
    NTSTATUS CreationStatus;          // can set to block!
} PS_CREATE_NOTIFY_INFO, *PPS_CREATE_NOTIFY_INFO;

What happens when the AV tries to use this file object to scan the image?

5. The Complete Timing Analysis

Here is a detailed timeline showing the state of the file at each inspection point during the ghosting sequence:

At every single inspection point, the AV either sees an empty file, cannot open the file because it is delete-pending, or cannot find the file because it has been deleted. There is no point in the sequence where the AV can both access the file and see malicious content.

6. Comparison: How Each Technique Handles the Scan Points

7. Kernel Callback Limitations

Understanding why the kernel’s callback architecture has this gap reveals a fundamental design assumption:

8. ETW (Event Tracing for Windows) Visibility

ETW provides additional visibility but has its own limitations in detecting ghosting:

ETW-based detection is possible but requires event correlation: linking the file creation event, the disposition change, the write, the section creation, and the process creation into a single chain. This is non-trivial and most EDR products do not correlate these events in real time.