PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

Last update: Dec 26, 2022

Overview

TiEtwAgent - ETW-based process injection detection

This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode visibility.

The project depends on the microsoft/krabsetw library for ETS setup and consumption.

An accompanying blog post can be found here: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection

Adding new detections

Detection functions can be easily added in DetectionLogic.cpp, and called from detect_event(GenericEvent evt) for any source event type. Support for new event fields can be easily added by appending their name to the map in GenericEvent class declaration.

Setup instructions

Assuming you do not have a Microsoft-trusted signing certificate:

Put your machine in the test signing mode with bcdedit
Generate a self-signed certificate with ELAM and Code Signing EKU
Sign TiEtwAgent.exe and your ELAM driver with the certificate
./TiEtwAgent install
net start TiEtwAgent
Look for logs, by default in C:\Windows\Temp\TiEtwAgent.txt

TODO

PPL Service, event parsing
First detection
Detection lifecycle
Risk based lifecycle

PS. If you do not want to write an ELAM driver, you can get one from https://github.com/pathtofile/PPLRunner/tree/main/elam_driver

Special thanks to @pathtofile for the post here: https://blog.tofile.dev/2020/12/16/elam.html

Security product hook detection

HookDump EDR function hook dumping Please refer to the Zeroperil blog post for more information https://zeroperil.co.uk/hookdump/ Building source In o

187 Dec 28, 2022

You Only Look Twice: Rapid Multi-Scale Object Detection In Satellite Imagery

YOLT You Only Look Twice: Rapid Multi-Scale Object Detection In Satellite Imagery As of 24 October 2018 YOLT has been superceded by SIMRDWN YOLT is an

618 Dec 23, 2022

WhyNotWin11 - Detection Script to help identify why your PC isn't Windows 11 ready

Detection Script to help identify why your PC isn't Windows 11 ready

5.9k Dec 28, 2022

Sqrt OS is a simulation of an OS scheduler and memory manager using different scheduling algorithms including Highest Priority First (non-preemptive), Shortest Remaining Time Next, and Round Robin.

A CPU scheduler determines an order for the execution of its scheduled processes; it decides which process will run according to a certain data structure that keeps track of the processes in the system and their status. A process, upon creation, has one of the three states: Running, Ready, Blocked (doing I/O, using other resources than CPU or waiting on unavailable resource).

18 Apr 15, 2022

Remote Download and Memory Execute for shellcode framework

RmExecute Remote Download and Memory Execute for shellcode framework 远程下载并内存加载的ShellCode框架，暂不支持X64 参（抄）考（袭）项目 windows下shellcode提取模板的实现主要抄袭来源，直接使用这位大佬

52 Dec 25, 2022

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

1.5k Jan 4, 2023

A fast image processing library with low memory needs.

libvips : an image processing library Introduction libvips is a demand-driven, horizontally threaded image processing library. Compared to similar lib

7.5k Dec 29, 2022

Bytehound - a memory profiler for Linux

Bytehound - a memory profiler for Linux Features Can be used to analyze memory leaks, see where exactly the memory is being consumed, identify tempora

3.3k Jan 4, 2023

WAFer is a C language-based software platform for scalable server-side and networking applications. Think node.js for C programmers.

WAFer WAFer is a C language-based ultra-light scalable server-side web applications framework. Think node.js for C programmers. Because it's written i

693 Dec 6, 2022

Comments

Is this still working ?
The service is running and in process explorer I can see it is marked as PsProtectedSignerAntimalware-Light but nothing is in C:\Windows\Temp\TiEtwAgent.txt, the file doesn't even exist.

Is everything logged, I triggered a Meterpreter payload on the machine hoping that would force event generations and have the logfile created. It didn't work. Any debug logs ? dbgview or other ?

Here is the output I am getting:

C:\Users\pussinboots\Desktop>TiEtwAgent.exe install TiEtwSensor: Installing the Early Launch Anti-Malware drivers TiEtwSensor: Opening driver file: elam_driver.sys TiEtwSensor: ELAM driver has been installed successfully TiEtwSensor: Installing the agent service TiEtwSensor: Service 'TiEtwAgent' already exists C:\Users\pussinboots\Desktop>TiEtwAgent.exe uninstall TiEtwSensor: Uninstalling the service TiEtwSensor: ControlService(Stop) Error: 5

It appears I can not remove it anymore. Does a process need to be PPL to uninstall it ?

Awesome project though ! Thanks so much for sharing !!
good first issue question
opened by pussinboots1992 5
System error 577?

Hello,

I have been trying to make this work. I am successfully installing the service but when I do net start TiEtwAgent I am getting the issue in the below screenshot

This is Windows 10 pro 19044.1237, obvsiouly in testsigning mode.

opened by trickster0 3