Telemetry Sourcerer

Introduction

Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows.

Red teamers and security enthusiasts can use this tool in a lab environment to:

• Identify collection-based blind spots in the products they're up against.
• Determine which sources of telemetry generate particular types of events.
• Validate whether using the tool's tampering capabilities can lead to detection.

For more information on building a private lab, consider reading my post on Diverting EDR Telemetry to Private Infrastructure.

Features

• Enumerates various kernel-mode callbacks with the ability to suppress them.
• Detects inline user-mode hooks within the process, with the ability to unhook them.
• Lists ETW sessions and providers while highlighting potentially relevant ones to disable.

Screenshots

Usage Instructions

1. Download the latest release.
2. Extract files.
3. Launch the executable.

Kernel-mode Callbacks

To view kernel-mode callbacks, consider enabling test signing mode or signing the driver with a valid certificate:

Test Signing Mode

1. Disable BitLocker and Secure Boot.
2. Open an elevated Command Prompt window.
3. Enter bcdedit.exe -set TESTSIGNING ON.
4. Reboot system.
5. Launch Telemetry Sourcerer with elevated privileges.

Sign Driver

1. Get SignTool from the Windows SDK and an appropriate cross-certificate from Microsoft Docs.
2. signtool sign /a /ac "cross-cert.cer" /f "cert.pfx" /p "password" TelemetrySourcererDriver.sys
3. Launch Telemetry Sourcerer with elevated privileges.

Caveats and Limitations

• This tool is meant for research purposes only and is not OPSEC-safe for production use.
• Compiled with Visual Studio 2019 using the Windows 10 SDK (10.0.19041.0) and WDK (2004).
• Currently does not look for IAT/EAT user-mode hooks, or kernel-mode hooks.
• The driver has not been thoroughly tested for abuse cases.
• Tested on Windows 7 and 10 only.

Credits

This tool was developed by @Jackson_T but builds upon the work of others:

• @gentilkiwi and @fdiskyou for driver code that enumerates callback functions.
• @0x00dtm for the inline user-mode hook comparison logic.

Related Articles and Projects

• @matterpreter: Mimidrv In Depth: Exploring Mimikatz’s Kernel Driver
• @fdiskyou: Windows Kernel Ps Callbacks Experiments
• @matteomalvica: Silencing the EDR. How to disable process, threads and image-loading detection callbacks.
• @0x00dtm: Defeating Userland Hooks (ft. Bitdefender) (Code)
• @palantir: Tampering with Windows Event Tracing: Background, Offense, and Defense

Licence

This project is licensed under the Apache License 2.0.