Kernel

Sensecon 23: from Windows drivers to an almost fully working EDR

31 January 2024 ~39 min By Aurelien Chalot
Callbacks Driver Edr Hooking Kernel Rootkit Shellcodes Ssdt Winapi Windows Rootkits Shellcode
TL;DR I wanted to better understand EDR’s so I built a dummy EDR and talk about it here. EDR (Endpoint Detection and Response) is a kind of security product that aims to detect abnormal activities being executed on a computer or a server. When looking for resources about how EDR’s work, I realised that, even if there is a lot of literature available about EDR’s, there aren’t many articles explaining how an EDR’s is architected and how the different components of a EDR are orchestrated. This article aims to demystify how EDR’s work while building a custom one that will implement a few techniques used by real EDR’s.

Filter-Mute Operation: Investigating EDR Internal Communication

28 July 2023 ~14 min By jeanpascal.thomas@orangecyberdefense.com
Edr Kernel Reversing Windows Av Bypass Reverse Engineering
For our annual internal hacker conference dubbed SenseCon in 2023, I decided to take a look at communication between a Windows driver and its user-mode process. Here are some details about that journey. TL;DR Attackers could use Windows kernel R/W exploit primitive to avoid communication between EDR_Driver.sys and its EDR_process.exe. As a result some EDR detection mechanisms will be disabled and make it (partially) blind to malicious payloads. This blogpost describes an alternative approach which doesn’t remove kernel callbacks and gives some recommendations for protecting against this “filter-mute” attack.