At this year VB2013 conference Ralf Hund gave a presentation on “Hardware-Assisted System Monitoring“. He described how modern hypervisor extensions can be utilized to realize a performant, transparent and isolated system monitoring. Use cases of this monitoring system are mainly the analysis of malware, especially of highly sophisticated instances such as APTs and kernel rootkis.
The slides are available here and the video is here.
