admin/dobin-RedEdr
1
0
Fork 0
mirror of https://github.com/dobin/RedEdr synced 2026-08-09 12:30:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

feature: defender modules logging

Browse Source
This commit is contained in:
Dobin Rutishauser
2026-06-14 17:36:01 +02:00
parent f2e69a8571
commit 9be1e468a3
6 changed files with 70 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RedEdrPplService/control.cpp
+43 -6
View File
@@ -60,13 +60,50 @@ DWORD WINAPI ServiceControlPipeThread(LPVOID param) {
g_ProcessResolver.RefreshTargetMatching();
BOOL doDefenderTrace = j.value("do_defendertrace", false) ? TRUE : FALSE;
std::vector<std::string> defenderTargets = {"msmpeng.exe"};
SetDefenderTraceConfig(doDefenderTrace, defenderTargets);
SetDefenderTraceConfig(doDefenderTrace);
nlohmann::json start_event;
start_event["event"] = "ppl_start";
start_event["type"] = "meta";
SendEmitterPipe((char *) start_event.dump().c_str());
if (doDefenderTrace) {
DWORD pid = FindProcessIdByName(L"MsMpEng.exe");
if (pid != 0) {
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
if (hProcess) {
LOG_A(LOG_INFO, "Control: Found MsMpEng.exe (PID: %lu)", pid);
ProcessPebInfoRet pebInfo = ProcessPebInfo(hProcess);
LOG_A(LOG_INFO, "Control: MsMpEng.exe base address: 0x%llx", pebInfo.image_base);
std::vector<ProcessLoadedDll> modules = ProcessEnumerateModules(hProcess);
for (const auto& mod : modules) {
// Exclude modules in SYSTEM32 (case-insensitive check)
std::string modNameLower = mod.name;
std::transform(modNameLower.begin(), modNameLower.end(), modNameLower.begin(), ::tolower);
if (modNameLower.find("system32") != std::string::npos) {
continue;
}
nlohmann::json defender_event;
defender_event["event"] = "defender_module";
defender_event["type"] = "meta";
defender_event["pid"] = pid;
defender_event["name"] = mod.name;
defender_event["base"] = mod.dll_base;
defender_event["size"] = mod.size;
SendEmitterPipe((char*)defender_event.dump().c_str());
LOG_A(LOG_INFO, "Control: MsMpEng.exe module: %s at 0x%llx (size: %lu)", mod.name.c_str(), mod.dll_base, mod.size);
}
CloseHandle(hProcess);
} else {
LOG_A(LOG_ERROR, "Control: Failed to open msmpeng.exe process. Error: %lu", GetLastError());
}
} else {
LOG_A(LOG_WARNING, "Control: msmpeng.exe process not found");
}
}
nlohmann::json start_event3;
start_event3["event"] = "ppl_start3";
start_event3["type"] = "meta";
SendEmitterPipe((char *) start_event3.dump().c_str());
} else {
LOG_A(LOG_ERROR, "Control: Start command missing 'targets' array");
}
RedEdrPplService/etwtihandler.cpp
+11 -5
View File
@@ -17,11 +17,9 @@ unsigned int events_all = 0;
unsigned int events_processed = 0;
volatile BOOL g_DoDefenderTrace = FALSE;
static std::vector<std::string> g_DefenderTraceTargetNames;
void SetDefenderTraceConfig(BOOL enabled, const std::vector<std::string>& targetNames) {
void SetDefenderTraceConfig(BOOL enabled) {
g_DoDefenderTrace = enabled;
g_DefenderTraceTargetNames = targetNames;
}
void event_callback(const EVENT_RECORD& record, const krabs::trace_context& trace_context) {
@@ -82,6 +80,9 @@ void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace
// Check if destination is one of our target processes
if (j.contains("pid") && !j["pid"].is_null()) {
DWORD targetPid = j["pid"].get<DWORD>();
if (targetPid == 0 || targetPid == 0xFFFFFFFF) {
return;
}
Process* targetProcess = g_ProcessResolver.getObject(targetPid);
if (targetProcess == NULL) {
@@ -94,6 +95,9 @@ void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace
// Mostly TargetProcessId, see https://blog.deeb.ch/posts/windows-telemetry/
else if (j.contains("targetprocessid") && !j["targetprocessid"].is_null()) {
DWORD targetPid = j["targetprocessid"].get<DWORD>();
if (targetPid == 0 || targetPid == 0xFFFFFFFF) {
return;
}
Process* targetProcess = g_ProcessResolver.getObject(targetPid);
if (targetProcess == NULL) {
@@ -106,7 +110,8 @@ void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace
// Check if filename matches any of our target processes
else if (j.contains("filename") && !j["filename"].is_null()) {
std::string filename = j["filename"].get<std::string>();
for (const auto& targetProcessName : g_DefenderTraceTargetNames) {
const auto& targetNames = g_ProcessResolver.GetTargetNames();
for (const auto& targetProcessName : targetNames) {
if (ends_with_case_insensitive(filename, targetProcessName)) {
SendEmitterPipe((char*)j.dump().c_str());
break;
@@ -116,7 +121,8 @@ void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace
// Check if name matches any of our target processes
else if (j.contains("name") && !j["name"].is_null()) {
std::string name = j["name"].get<std::string>();
for (const auto& targetProcessName : g_DefenderTraceTargetNames) {
const auto& targetNames = g_ProcessResolver.GetTargetNames();
for (const auto& targetProcessName : targetNames) {
if (ends_with_case_insensitive(name, targetProcessName)) {
SendEmitterPipe((char*)j.dump().c_str());
break;
RedEdrPplService/etwtihandler.h
+1 -1
View File
@@ -10,4 +10,4 @@ void event_callback(const EVENT_RECORD& record, const krabs::trace_context& trac
void event_callback_defendertrace(const EVENT_RECORD& record, const krabs::trace_context& trace_context);
extern volatile BOOL g_DoDefenderTrace;
void SetDefenderTraceConfig(BOOL enabled, const std::vector<std::string>& targetNames);
void SetDefenderTraceConfig(BOOL enabled);