[cobbzilla]

I understand that once a rootkit is installed, all bets are off. I was wondering if the syscalls by which the rootkit gets installed will be obfuscated to make them look more like a benign/normal process, and evade detection by a malware-syscall-pattern-recognizer. or are some malware syscall patterns essentially "unhideable"?

[ShroudedNight]

Will there be attempts to hide system call patterns from intrusion detection / prevention systems if they take off? Probably, yes: https://www.eecs.berkeley.edu/~daw/papers/mimicry.pdf

Will they work? Maybe: https://web.cs.dal.ca/~zincir/bildiri/pst08-gn.pdf

Disclaimer: I was one of Anil Somayaji's grad students at one point in the not so distant past.