7fcde5fda4
Update README with project status
...
Added a note about project discontinuation and breaking change notification.
2026-03-24 18:38:04 +00:00
b219cd746b
Update SendTelemetry to include process ID and adjust calls in PostOperationCreate and PostOperationSetInformation
2026-02-15 16:40:41 +00:00
525aec25e9
Minifilter now filters system wide on changes not limited to scil dir
2026-02-15 16:20:19 +00:00
ad2d347fa0
Add InterceptedEventType to SendTelemetry and update calls in PostOperationCreate and PostOperationSetInformation
2026-02-15 15:53:37 +00:00
8e8d07837a
SendTelemetry accepts path and message parameters; update calls in PostOperationCreate and PostOperationSetInformation
2026-02-15 14:40:06 +00:00
fd63a961f9
Minifilter now communicates with a usermode listener via filter messaging
2026-02-15 13:19:32 +00:00
87de958410
improve file write signal
2026-02-08 15:38:14 +00:00
d954b5298e
Check for file rename events only
2026-02-08 15:15:08 +00:00
2ea2a1891b
Spelling
2026-02-08 14:39:21 +00:00
497abb08cb
Add ransomware detection minifilter
2026-02-08 14:30:05 +00:00
4c973cf36b
Update gitignore
2026-02-08 12:58:01 +00:00
55334d8b91
Merge pull request #78 from 0xflux/investigate-nt-open-proc-err
...
VEH detection and some other internals
2026-01-11 10:11:33 +00:00
cd400c66a9
Stuff including VEH detection
2026-01-11 10:10:43 +00:00
5918cae277
Cargo warning cleanup
2026-01-07 07:14:36 +00:00
72bc50fd40
Revert for 25H2
2025-11-29 20:47:21 +00:00
0ca3acb2b0
Bug fix: allocate in the non-paged pool for temporal copy
2025-11-29 17:19:38 +00:00
fcc307ac32
w
2025-11-29 16:46:31 +00:00
b065e8861a
w
2025-11-29 16:46:28 +00:00
3a131f8b53
Upddate wdk mutex
2025-10-12 11:05:34 +01:00
6b28e9259f
Add driver model to workspace visible toml
2025-10-12 11:05:25 +01:00
0f6a86636a
Update readme
2025-10-11 17:25:04 +01:00
d0ccc405ba
Merge pull request #77 from 0xflux/new-injection-experimental
...
Use APC for DLL injection
2025-10-11 17:21:58 +01:00
8348962a6a
Stable changes using APC to inject Sanctum DLL into target process.
...
Currently only targeting malware.exe and notepad.exe; targeting wider applications is causing some bugs with regard to the DLL not being correctly signed etc, so that likely needs an environment change and some further testing.. but this works, and in stable!
There is a bug with Ghost Hunting where it is not picking up on some NtOpenProcess calls.. very annoying, and needs investigating.
2025-10-11 17:20:16 +01:00
b7610ade39
Bring in anyhow
2025-10-09 17:28:55 +01:00
64a05993eb
Correctly patch shellcode stub for injecting DLL
2025-10-09 16:06:00 +01:00
29bb32e95a
Begin sanc DLL injection primitives for processes
2025-10-08 10:50:27 +01:00
e5dfe163c3
There's a lot of uncommitted changes here from when last I looked at this, that I am going to commit, I was working towards a better process to inject the EDR's DLL. Going to commit these and I can unpick anything as required as I go through with some new changes now.
2025-10-08 07:44:03 +01:00
8b19cd3727
Refactor AltSyscalls and process callbacks; remove unused global variable and commented-out code
2025-08-17 13:39:15 +01:00
d921a26c08
Refactor imports for clarity and add debug message box for DLL injection
2025-08-17 13:38:42 +01:00
42431b343e
Expose inner field in MonitoredApis and enhance SensitiveAPI enum with PartialEq and Eq traits; simplify logging for expired GhostHuntingTimer.
2025-08-17 13:38:06 +01:00
0c6926d3e8
Reorder calls
2025-08-17 13:37:41 +01:00
799a7725cb
spellings
2025-08-17 13:36:44 +01:00
0895814bff
Add fmt to save
2025-08-17 08:34:43 +01:00
73baeee814
Merge pull request #75 from 0xflux/process-containment
...
Process containment after direct syscalls detected
2025-08-16 08:30:05 +01:00
ae9fb9db62
Refactor Process initialization and syscall handling for improved clarity and functionality
2025-08-16 08:28:36 +01:00
37bd339a70
Refactor Process struct and syscall processing logic for improved clarity and functionality
2025-08-16 08:14:58 +01:00
3f77e5124c
Rename processes_has_disallowed_monitored_syscalls to is_blocking_syscalls for clarity and update its usage in syscall processing logic
2025-08-15 21:20:57 +01:00
7228520bcb
Remove deadlock
2025-08-15 21:14:31 +01:00
745aff0c94
Checkpoint for containment branch - this currently is locking the process
2025-08-15 07:34:13 +01:00
0588972b64
Open process via Direct Syscalls for detection surface
2025-08-13 18:20:21 +01:00
acec87aceb
Implement Ghost Hunting for NtCreateRemoteThread where the target pid != current pid
2025-08-11 19:24:33 +01:00
4958f8833b
New way of monitoring function pointers for abuse
2025-08-10 18:15:25 +01:00
020d64c6f9
Detects thread start on sensitive APIs
2025-08-10 16:07:49 +01:00
6a27dada5f
Intercept for NtWriteVirtualMemory in driver
2025-08-10 12:18:38 +01:00
928db7e9e0
Mostly implement ktrap_get_stack_args, to make stack arg ABI retrieval easier
2025-08-10 12:11:20 +01:00
925e3462c4
Update architecture diagram
2025-08-10 10:33:39 +01:00
10d99091ca
excalis
2025-08-10 10:23:29 +01:00
00161600ad
Use extract_if to identify expired ghost hunt timers
2025-08-09 20:41:09 +01:00
a4d47a82b7
Hook up alt syscalls to the process monitor for Ghost Hunting
2025-08-09 19:13:16 +01:00
8fea2ce7fb
Clean up ghost hunting
2025-08-09 19:00:33 +01:00
flux