Etw-SyscallMonitor - GitLite

KO | EN

gitlite — search

#javascript #react #ai #go #android #machine-learning #rust #nodejs #windows #awesome #cli #kubernetes #mcp #open-source

Etw-SyscallMonitor

(★ 90)

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

파일 탐색기

최종 버전 다운로드 (.zip)

- - EtwUserTrace.cs
  - EtwUserTraceProvider.cs
  - Microsoft-Windows-Kernel-Audit-API-Calls.cs
  - Microsoft-Windows-Kernel-EventTracing.cs
  - Microsoft-Windows-Kernel-File.cs
  - Microsoft-Windows-Kernel-Network.cs
  - Microsoft-Windows-Kernel-Process.cs
  - Microsoft-Windows-Kernel-Registry.cs
  - Microsoft-Windows-Security-Auditing.cs
  - MIcrosoft-Windows-Threat-Intelligence.cs
  - Microsoft-Windows-WFP.cs
  - Microsoft-Windows-Win32k.cs
- - PPLKillerDLL.dll
- - AssemblyInfo.cs
- - HashUtils.cs
  - Log.cs
  - MemoryExtensions.cs
  - PathUtils.cs
  - PeMetadata.cs
  - PeReaderExtensions.cs
  - ProcessUtils.cs
  - SymbolUtils.cs
  - TokenUtils.cs
  - Win32.cs
- App.config
- app.manifest
- ETW-SyscallMonitor.csproj
- MainWindow.xaml
- MainWindow.xaml.cs
- MemoryMap.cs
- packages.config
- ProcessCreationTraitsMap.cs
- ProcessProfile.cs
- Program.cs
.gitignore
ETW-SycallMonitor.sln
ETW_syscall_monitor.png
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![screenshot](https://raw.githubusercontent.com/jdu2600/Etw-SyscallMonitor/main/ETW_syscall_monitor.png)

# Hunting hidden shellcode via syscall summaries

You can roughly determine an executable's purpose from its Import Table (or [ImpHash](https://www.mandiant.com/resources/blog/tracking-malware-import-hashing)).
<br/>Or, better yet, from a summary of its [capa](https://github.com/mandiant/capa)bilities extracted by automated static analysis of callsites and parameters.

This project is the *runtime* equivalent.

Using kernel ETW telemetry, we record the set of interesting syscalls (plus interesting parameters).

Malware can't use anti-analysis approaches to hide from the kernel at runtime. If (user-mode) malware needs to make syscalls to perform tasks then it must make those calls.

Anomalies in this set for a given process should have sufficient information to identify the presence of malicious code on the system. However, the profile will not have sufficient granularity to establish a perfect timeline of events.

See [[Black Hat Asia 2023] You Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode](https://www.blackhat.com/asia-23/briefings/schedule/index.html#you-can-run-but-you-cant-hide---finding-the-footprints-of-hidden-shellcode-31237) for more details.

#### Notes
 * I'm not a UX developer.
 * This is a rough proof of concept.
 * For best results, run on Windows 10.
 * Uses BYOVD to enable PPL in order to collect Microsoft-Windows-Threat-Intelligence events
 * Periodically outputs a whole system `SyscallSummary.json` to the current directory
 * Periodically outputs per-process profiles to `SycallSummaries\%executable%__%startup_hash%.json`