feature: defender msmpeng.exe related events in etw-ti

RedEdrPplService/control.cpp

@@ -5,6 +5,7 @@
 #include "../Shared/common.h"
 #include "logging.h"
 #include "etwtireader.h"
+#include "etwtihandler.h"
 #include "piping.h"
 #include "json.hpp"
 #include "process_resolver.h"
@@ -57,6 +58,9 @@ DWORD WINAPI ServiceControlPipeThread(LPVOID param) {
                             std::vector<std::string> targets = j["targets"];
                             g_ProcessResolver.SetTargetNames(targets);
 
+                            BOOL doDefenderTrace = j.value("do_defendertrace", false) ? TRUE : FALSE;
+                            SetDefenderTraceConfig(doDefenderTrace, targets);
+
                             nlohmann::json start_event;
                             start_event["event"] = "ppl_start";
                             start_event["type"] = "meta";

RedEdrPplService/etwtihandler.cpp

@@ -9,12 +9,20 @@
 #include "json.hpp"
 #include "etw_krabs.h"
 #include "process_resolver.h"
+#include "utils.h"
 
 
 // Used for debug currently
 unsigned int events_all = 0;
 unsigned int events_processed = 0;
 
+volatile BOOL g_DoDefenderTrace = FALSE;
+static std::vector<std::string> g_DefenderTraceTargetNames;
+
+void SetDefenderTraceConfig(BOOL enabled, const std::vector<std::string>& targetNames) {
+    g_DoDefenderTrace = enabled;
+    g_DefenderTraceTargetNames = targetNames;
+}
 
 void event_callback(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
     krabs::schema schema(record, trace_context.schema_locator);
@@ -47,3 +55,72 @@ void event_callback(const EVENT_RECORD& record, const krabs::trace_context& trac
 	j["process_name"] = process->name;
     SendEmitterPipe((char*)j.dump().c_str());
 }
+
+
+// Handle ETW-TI events from msmpeng.exe (Windows Defender) for defender trace
+void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
+    if (!g_DoDefenderTrace) {
+        return;
+    }
+
+    krabs::schema schema(record, trace_context.schema_locator);
+
+    // Resolve source process — must be msmpeng.exe
+    DWORD processId = record.EventHeader.ProcessId;
+    Process* process = g_ProcessResolver.getObject(processId);
+    if (process == NULL) {
+        return;
+    }
+    if (!contains_case_insensitive(process->name, "msmpeng")) {
+        return;
+    }
+
+    // Convert ETW to JSON
+    nlohmann::json j = KrabsEtwEventToJsonStr(record, schema);
+    j["process_name"] = process->name;
+
+    // Check if destination is one of our target processes
+    if (j.contains("pid") && !j["pid"].is_null()) {
+        DWORD targetPid = j["pid"].get<DWORD>();
+
+        Process* targetProcess = g_ProcessResolver.getObject(targetPid);
+        if (targetProcess == NULL) {
+            return;
+        }
+        if (targetProcess->observe) {
+            SendEmitterPipe((char*)j.dump().c_str());
+        }
+    }
+    // Mostly TargetProcessId, see https://blog.deeb.ch/posts/windows-telemetry/
+    else if (j.contains("targetprocessid") && !j["targetprocessid"].is_null()) {
+        DWORD targetPid = j["targetprocessid"].get<DWORD>();
+
+        Process* targetProcess = g_ProcessResolver.getObject(targetPid);
+        if (targetProcess == NULL) {
+            return;
+        }
+        if (targetProcess->observe) {
+            SendEmitterPipe((char*)j.dump().c_str());
+        }
+    }
+    // Check if filename matches any of our target processes
+    else if (j.contains("filename") && !j["filename"].is_null()) {
+        std::string filename = j["filename"].get<std::string>();
+        for (const auto& targetProcessName : g_DefenderTraceTargetNames) {
+            if (ends_with_case_insensitive(filename, targetProcessName)) {
+                SendEmitterPipe((char*)j.dump().c_str());
+                break;
+            }
+        }
+    }
+    // Check if name matches any of our target processes
+    else if (j.contains("name") && !j["name"].is_null()) {
+        std::string name = j["name"].get<std::string>();
+        for (const auto& targetProcessName : g_DefenderTraceTargetNames) {
+            if (ends_with_case_insensitive(name, targetProcessName)) {
+                SendEmitterPipe((char*)j.dump().c_str());
+                break;
+            }
+        }
+    }
+}

RedEdrPplService/etwtihandler.h

@@ -1,7 +1,13 @@
 #pragma once
 
 #include <evntrace.h>
+#include <vector>
+#include <string>
 
 #include <krabs.hpp>
 
-void event_callback(const EVENT_RECORD& record, const krabs::trace_context& trace_context);
+void event_callback(const EVENT_RECORD& record, const krabs::trace_context& trace_context);
+void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace_context& trace_context);
+
+extern volatile BOOL g_DoDefenderTrace;
+void SetDefenderTraceConfig(BOOL enabled, const std::vector<std::string>& targetNames);

RedEdrPplService/etwtireader.cpp

@@ -59,6 +59,7 @@ void StartEtwtiReader() {
     }
     ti_provider.trace_flags(ti_provider.trace_flags() | EVENT_ENABLE_PROPERTY_STACK_TRACE);
     ti_provider.add_on_event_callback(event_callback);
+    ti_provider.add_on_event_callback(event_callback_defendertrace);
     trace_ppl.enable(ti_provider);
 
     LOG_A(LOG_INFO, "Start reading from ETW-TI");