TiEtwAgent project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode visibility.
The project depends on the microsoft/krabsetw library for ETS setup and consumption.
An accompanying blog post can be found here: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection
Adding New Detections
Detection functions can be easily added in DetectionLogic.cpp
, and called from detect_event(GenericEvent evt)
for any source event type. Support for new event fields can be easily added by appending their name to the map in GenericEvent
class declaration.
Setup Instructions
Assuming you do not have a Microsoft-trusted signing certificate:
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…
Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…