Jamie Butler
The rootkit researcher behind FU and DKOM, which hid processes by simply removing them from the kernel's own bookkeeping.
Early rootkits hooked system calls, which could be caught by checking the call tables. Butler sidestepped that. With Direct Kernel Object Manipulation, presented at Black Hat in 2004, the rootkit edited kernel data structures directly: a process was unlinked from the doubly linked list Windows uses to enumerate processes, yet kept running because the scheduler works on threads. No hooks, nothing to find. His FU rootkit became the reference implementation.
In 2005 he co-wrote Rootkits: Subverting the Windows Kernel with Greg Hoglund. He then moved to the other side, insofar as the sides differed, building memory forensics at Mandiant — tools that hunt for exactly the kind of inconsistency he had taught the world to create.