admin/0xflux-sanctum
1
0
Fork 0
mirror of https://github.com/0xflux/sanctum synced 2026-06-06 15:04:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 7fcde5fda4 Update README with project status main flux 2026-03-24 18:38:04 +00:00
  • b219cd746b Update SendTelemetry to include process ID and adjust calls in PostOperationCreate and PostOperationSetInformation flux 2026-02-15 16:40:41 +00:00
  • 525aec25e9 Minifilter now filters system wide on changes not limited to scil dir flux 2026-02-15 16:20:19 +00:00
  • ad2d347fa0 Add InterceptedEventType to SendTelemetry and update calls in PostOperationCreate and PostOperationSetInformation flux 2026-02-15 15:53:37 +00:00
  • 8e8d07837a SendTelemetry accepts path and message parameters; update calls in PostOperationCreate and PostOperationSetInformation flux 2026-02-15 14:40:06 +00:00
  • fd63a961f9 Minifilter now communicates with a usermode listener via filter messaging flux 2026-02-15 13:19:32 +00:00
  • 87de958410 improve file write signal flux 2026-02-08 15:38:14 +00:00
  • d954b5298e Check for file rename events only flux 2026-02-08 15:15:08 +00:00
  • 2ea2a1891b Spelling flux 2026-02-08 14:39:21 +00:00
  • 497abb08cb Add ransomware detection minifilter flux 2026-02-08 14:30:05 +00:00
  • 4c973cf36b Update gitignore flux 2026-02-08 12:58:01 +00:00
  • e8da493808 Bump time from 0.3.41 to 0.3.47 dependabot/cargo/time-0.3.47 dependabot[bot] 2026-02-05 18:42:35 +00:00
  • 8125df657e Bump bytes from 1.10.1 to 1.11.1 dependabot/cargo/bytes-1.11.1 dependabot[bot] 2026-02-03 19:21:46 +00:00
  • 55334d8b91 Merge pull request #78 from 0xflux/investigate-nt-open-proc-err flux 2026-01-11 10:11:33 +00:00
  • cd400c66a9 Stuff including VEH detection flux 2026-01-11 10:10:43 +00:00
  • 5918cae277 Cargo warning cleanup flux 2026-01-07 07:14:36 +00:00
  • 72bc50fd40 Revert for 25H2 flux 2025-11-29 20:47:21 +00:00
  • 0ca3acb2b0 Bug fix: allocate in the non-paged pool for temporal copy flux 2025-11-29 17:19:38 +00:00
  • fcc307ac32 w flux 2025-11-29 16:46:31 +00:00
  • b065e8861a w flux 2025-11-29 16:46:28 +00:00
  • 3a131f8b53 Upddate wdk mutex flux 2025-10-12 11:05:34 +01:00
  • 6b28e9259f Add driver model to workspace visible toml flux 2025-10-12 11:05:25 +01:00
  • 0f6a86636a Update readme flux 2025-10-11 17:25:04 +01:00
  • d0ccc405ba Merge pull request #77 from 0xflux/new-injection-experimental flux 2025-10-11 17:21:58 +01:00
  • 8348962a6a Stable changes using APC to inject Sanctum DLL into target process. flux 2025-10-11 17:20:16 +01:00
  • b7610ade39 Bring in anyhow flux 2025-10-09 17:28:55 +01:00
  • 64a05993eb Correctly patch shellcode stub for injecting DLL flux 2025-10-09 16:06:00 +01:00
  • 29bb32e95a Begin sanc DLL injection primitives for processes flux 2025-10-08 10:50:27 +01:00
  • e5dfe163c3 There's a lot of uncommitted changes here from when last I looked at this, that I am going to commit, I was working towards a better process to inject the EDR's DLL. Going to commit these and I can unpick anything as required as I go through with some new changes now. flux 2025-10-08 07:44:03 +01:00
  • 8b19cd3727 Refactor AltSyscalls and process callbacks; remove unused global variable and commented-out code flux 2025-08-17 13:39:15 +01:00
  • d921a26c08 Refactor imports for clarity and add debug message box for DLL injection flux 2025-08-17 13:38:42 +01:00
  • 42431b343e Expose inner field in MonitoredApis and enhance SensitiveAPI enum with PartialEq and Eq traits; simplify logging for expired GhostHuntingTimer. flux 2025-08-17 13:38:06 +01:00
  • 0c6926d3e8 Reorder calls flux 2025-08-17 13:37:41 +01:00
  • 799a7725cb spellings flux 2025-08-17 13:36:44 +01:00
  • 0895814bff Add fmt to save flux 2025-08-17 08:34:43 +01:00
  • 73baeee814 Merge pull request #75 from 0xflux/process-containment flux 2025-08-16 08:30:05 +01:00
  • ae9fb9db62 Refactor Process initialization and syscall handling for improved clarity and functionality flux 2025-08-16 08:28:36 +01:00
  • 37bd339a70 Refactor Process struct and syscall processing logic for improved clarity and functionality flux 2025-08-16 08:14:58 +01:00
  • 3f77e5124c Rename processes_has_disallowed_monitored_syscalls to is_blocking_syscalls for clarity and update its usage in syscall processing logic flux 2025-08-15 21:20:57 +01:00
  • 7228520bcb Remove deadlock flux 2025-08-15 21:14:31 +01:00
  • 745aff0c94 Checkpoint for containment branch - this currently is locking the process flux 2025-08-15 07:34:13 +01:00
  • 0588972b64 Open process via Direct Syscalls for detection surface flux 2025-08-13 18:20:21 +01:00
  • acec87aceb Implement Ghost Hunting for NtCreateRemoteThread where the target pid != current pid flux 2025-08-11 19:24:33 +01:00
  • 4958f8833b New way of monitoring function pointers for abuse flux 2025-08-10 18:15:25 +01:00
  • 020d64c6f9 Detects thread start on sensitive APIs flux 2025-08-10 16:07:49 +01:00
  • 6a27dada5f Intercept for NtWriteVirtualMemory in driver flux 2025-08-10 12:18:38 +01:00
  • 928db7e9e0 Mostly implement ktrap_get_stack_args, to make stack arg ABI retrieval easier flux 2025-08-10 12:11:20 +01:00
  • 925e3462c4 Update architecture diagram flux 2025-08-10 10:33:39 +01:00
  • 10d99091ca excalis flux 2025-08-10 10:23:29 +01:00
  • 00161600ad Use extract_if to identify expired ghost hunt timers flux 2025-08-09 20:41:09 +01:00
  • a4d47a82b7 Hook up alt syscalls to the process monitor for Ghost Hunting flux 2025-08-09 19:13:16 +01:00
  • 8fea2ce7fb Clean up ghost hunting flux 2025-08-09 19:00:33 +01:00
  • 5c98e3782c Tidy up flux 2025-08-09 12:07:52 +01:00
  • 96efa89edd Remove processes from the monitor on termination flux 2025-08-09 12:07:47 +01:00
  • 5325469256 Clean up prints and unused functions flux 2025-08-09 11:45:37 +01:00
  • 201432c05d Discount pid 0 from process walk flux 2025-08-09 11:44:02 +01:00
  • 2a3c658c03 Standardise PID size for driver (u32) flux 2025-08-09 10:22:14 +01:00
  • 9a75a75053 Stabilise the alt syscall handlers flux 2025-08-09 10:09:46 +01:00
  • 09f14e19b5 Bug fixes and stability flux 2025-08-09 10:03:06 +01:00
  • 4d95a80e77 Remove ETW system, transitioning to Alt Syscalls flux 2025-08-07 21:51:55 +01:00
  • c2de406268 One joint source of syscall definitions flux 2025-08-07 21:44:29 +01:00
  • 68f7ea4b57 Deal with NtOpenProcess in Alt Syscalls flux 2025-08-07 21:19:30 +01:00
  • ee37a9eb6b Stabilising the unstable codebase, and working to a **clean** minimal POC for a stable release coming soon.. flux 2025-08-07 20:54:52 +01:00
  • efe32b62d5 Clean up file flux 2025-08-03 17:10:55 +01:00
  • e70c379a0b Update readme flux 2025-08-03 17:10:50 +01:00
  • 190d55698b Hells Hollow changes for blog research flux 2025-07-28 19:55:32 +01:00
  • ebdbfc99b6 Update readme flux 2025-06-25 07:01:50 +01:00
  • c2cee20e1a Fix hardcoded paths in file path strings. flux 2025-06-12 18:09:10 +01:00
  • e2ac18cd28 Update readme flux 2025-06-12 18:00:54 +01:00
  • 5786398191 misc flux 2025-06-12 17:59:49 +01:00
  • c126e17bf2 Source pid not required flux 2025-06-08 16:13:22 +01:00
  • a327b7905e Correctly get the current and remote PID for NTAVM flux 2025-06-08 16:11:15 +01:00
  • 8200672caa Bug fix: BSOD that occurred whilst doing process walk is now fixed via ref counting handles to prevent race condition. flux 2025-06-08 13:10:00 +01:00
  • 7e2a072ca8 Rm crashdump info flux 2025-06-08 11:40:54 +01:00
  • 0d63dd4449 Update readme flux 2025-06-07 22:18:49 +01:00
  • 80611184c1 crashdmp flux 2025-06-07 22:13:50 +01:00
  • 379c33c286 Create empty flux 2025-06-07 21:57:22 +01:00
  • 831ce7f84d Add tauri build tools to requirements flux 2025-05-30 20:41:06 +01:00
  • 425c052e70 Remove verification of signing flux 2025-05-30 20:40:07 +01:00
  • 2a6aaa5bb1 Permalink to build instructions flux 2025-05-29 20:14:05 +01:00
  • 501d6e5725 Bug fix: Use num elements not size of allocation when determining the buf size for GetUserNameW. flux 2025-05-29 19:56:14 +01:00
  • d92699c659 Remove username from Users config scan dir flux 2025-05-29 19:47:36 +01:00
  • 193c7d3efb Bug fix: Dynamically resolve logged in username to get path to driver in ELAM installer. flux 2025-05-29 19:45:29 +01:00
  • 776001f927 Update deploy instructions flux 2025-05-29 18:55:01 +01:00
  • 12c31cf40e Update readme flux 2025-05-29 18:32:35 +01:00
  • 1163c42a53 Update readme flux 2025-05-29 18:32:10 +01:00
  • f66a932a25 Update readme flux 2025-05-29 18:29:18 +01:00
  • 75743bd6df Update readme flux 2025-05-28 18:32:10 +01:00
  • a082871a07 Update readme flux 2025-05-28 18:11:49 +01:00
  • 0e5b27774a Update readme flux 2025-05-28 18:02:59 +01:00
  • 1c82c394a4 Update readme flux 2025-05-28 18:00:04 +01:00
  • 069fb744e0 revert binary name flux 2025-05-28 17:55:14 +01:00
  • 581295fa6c test signing in script flux 2025-05-28 17:26:34 +01:00
  • bcb9eebb3a Install script for VM flux 2025-05-28 16:59:45 +01:00
  • fa25ad913c clean files flux 2025-05-28 16:55:16 +01:00
  • 0aeef8a3c2 Auto rename of the injected dll to be sanctum.dll flux 2025-05-28 16:50:57 +01:00
  • 3f181f7c5e Better error message handling for elam installer binary. flux 2025-05-28 16:48:42 +01:00
  • ad95f25dda Show reboot info message on elam installer flux 2025-05-28 16:39:25 +01:00
  • be62e8122f Remove requirement for child process spawning flux 2025-05-28 16:00:24 +01:00
  • 081d735202 Serialise and send meaningful data to the worker syscall thread flux 2025-05-17 14:15:31 +01:00