How Virus Protection Works
Detection Pipeline
TRAE Guardian's virus protection follows a multi-layer detection pipeline to ensure comprehensive threat coverage:
- Whitelist Check: Process is first checked against the whitelist database (compiler tools, system processes)
- Signature Verification: Signed processes are handled by rogue software detection, not virus analysis
- PE Analysis: Unsigned processes undergo PE header analysis, entropy detection, and import table examination
- Heuristic Detection: Behavioral analysis based on process actions and system interactions
- Rule Engine Matching: Configurable rules for specific threat patterns
Key Detection Rules
| Rule ID | Description | Score | Action |
|---|---|---|---|
| R001 | Physical disk access (PhysicalDrive/Harddisk/Volume) | 35 | Terminate + MBR restore |
| R006 | SYSTEM registry modifications | 10 | Alert + Monitor |
| R007a | Run key write (auto-start) | 35 | Terminate |
| R010 | Process spawn monitoring | 0 (observation) | Track |
| R015 | Direct Syscall detection (0F 05 instruction) | 50 | Immediate terminate |
| R020 | NtRaiseHardError (BSOD API) | 50 | Immediate terminate |
Protection Features
MBR/GPT Protection
Automatic backup of MBR and GPT partition tables at startup. Real-time integrity checking with automatic restoration when modifications are detected. Protects against bootkit attacks like Rainbow Cat (MEMZ).
Physical Disk Interception
Blocks unsigned processes from opening PhysicalDrive handles. Uses NtQuerySystemInformation to scan process handles for sensitive device paths like \Device\Harddisk0\DR0.
Watchdog Group Termination
Simultaneous termination of mutually-protected malware processes. Opens all PROCESS_TERMINATE handles at once, then calls TerminateProcess simultaneously to eliminate race conditions.
High-Frequency Scanning
When ETW detects a new process, the state machine initiates 5 seconds of high-frequency (20ms interval) handle scanning to catch threats early.
PE Analysis
Static analysis of PE headers including entropy detection, import table examination, and section analysis to identify packed or obfuscated malware.
Signature Verification
Windows Authenticode signature verification with caching. Signed processes are handled by rogue software detection to prevent false positives.
Test Results & Success Stories
✅ Rainbow Cat (MEMZ)
Status: Successfully Detected & Terminated
Timeline:
- Process execution detected
- Physical disk access detected (R001)
- MBR modification detected
- MBR automatically restored
- Process terminated within seconds
✅ Watchdog Mutual Protection
Status: Successfully Cracked
Attack Scenario: 1 main process + 3 watchdog subprocesses with mutual monitoring
- All 4 processes terminated simultaneously
- No race condition during termination
- No watchdog restart detected
- Executable files deleted
Response Thresholds
Graded Response System
TRAE Guardian uses a risk scoring system with time-decay to determine appropriate responses:
| Score | Status | Response |
|---|---|---|
| 0 | Observation | Track process activity |
| 30 | Suspicious | High-frequency monitoring |
| 50 | Restricted | Limit process activities |
| 60 | Rogue Software | Display in rogue software tab |
| 70 | Quarantined | Terminate + quarantine |
| 80+ | Removed | Terminate + file deletion |