Unable to detect ghosttasks

[j-wsy]

Hi, love the tool.

I have a vm with a working ghosttask loaded (restarted and all that, and confirmed the ghosttask is functioning). I can see it in my regedit \tasks, and I can see it doesn't have a SD, as expected. I can see it doing the action I made it do.

Running the latest PersistenceSniper v1.16.0, I can't seem to detect it. I see a bunch of other false-positives, so the tool itself is working, but no output relating to ghosttask.

[j-wsy]

[j-wsy]

Here's another example using a ghosttask named "April1", on a separate clean vm. Could not detect using Find-AllPersistence.

Am I doing something wrong/do I need to do anything else?

[last-byte]

Hey there, solid copy. I’ll investigate it right away and fix it in the next minor release.

[j-wsy]

thanks, looking forward to it.

[daniele777]

Malware is fake amsi provider?