refactor

agent/AgentService.cpp

@@ -1,4 +1,3 @@
-#include "TiMemAgent.h"
 #include "AgentService.h"
 
 SERVICE_STATUS        g_ServiceStatus{ 0 };

agent/AgentService.h

@@ -1,4 +1,5 @@
 #pragma once
+#include "TiEtwAgent.h"
 
 #ifndef SERVICE_CONFIG
 #define SERVICE_CONFIG

agent/AgentWorker.cpp

@@ -1,6 +1,6 @@
-#include "../packages/Microsoft.O365.Security.Krabsetw.4.1.18/lib/native/include/krabs.hpp"
+#include <Microsoft.O365.Security.Krabsetw.4.1.18/lib/native/include/krabs.hpp>
 
-#include "TiMemAgent.h"
+#include "TiEtwAgent.h"
 #include "AgentService.h"
 #include "DetectionLogic.h"
 #include "YaraInstance.h"
@@ -109,6 +109,14 @@ DWORD agent_worker()
     provider<> provider(L"Microsoft-Windows-Threat-Intelligence");
     event_filter filter(predicates::id_is((int)KERNEL_THREATINT_TASK_ALLOCVM_REMOTE));
 
+    if (YARA_ENABLED) {
+        log_debug(L"TiEtwAgent: Setting up Yara\n");
+        YaraInstance yi;
+
+        yi.load_rules(YARA_RULE_DIR);
+        log_debug(L"TiEtwAgent: Yara setup complete\n");
+    }
+
     try {
         log_debug(L"TiEtwAgent: Setting up the trace session\n");
         provider.add_on_event_callback(parse_generic_event);

agent/DetectionLogic.cpp

@@ -1,5 +1,10 @@
 #include "DetectionLogic.h"
-#include "TiMemAgent.h"
+
+/************************************************************************************************************
+ADD NEW DETECTION RULES BELOW, BASED ON THE allocvm_remote_mega_generic EXAMPLE
+FIELD DECLARATIONS FOR EACH EVENT TYPE CAN BE FOUND HERE
+https://github.com/jdu2600/Windows10EtwEvents/blob/master/manifest/Microsoft-Windows-Threat-Intelligence.tsv
+************************************************************************************************************/
 
 // Simple detection relying on metadata of the allocated memory page
 const int ALLOC_PROTECTION{ PAGE_EXECUTE_READWRITE };
@@ -18,17 +23,12 @@ DWORD allocvm_remote_meta_generic(GenericEvent alloc_event) {
     return FALSE;
 }
 
-// Trigger Yara scan of the remotely allocated memory page
-VOID allocvm_remote_signatures(GenericEvent alloc_event) {
-    return;
-}
-
 VOID detect_event(GenericEvent evt) {
     // Run detection functions depending on source event type
     switch (evt.type) {
         case KERNEL_THREATINT_TASK_ALLOCVM_REMOTE:
             allocvm_remote_meta_generic(evt);
-            allocvm_remote_signatures(evt);
+            // your custom function here
             break;
         case KERNEL_THREATINT_TASK_PROTECTVM_REMOTE:
         case KERNEL_THREATINT_TASK_MAPVIEW_REMOTE:

agent/DetectionLogic.h

@@ -1,9 +1,5 @@
 #pragma once
-#include <Windows.h>
-#include <vector>
-#include <iostream>
-#include <map>
-#include <string>
+#include "TiEtwAgent.h"
 
 using std::vector;
 using std::wstring;
@@ -33,8 +29,6 @@ enum DETECTIONS {
     ALLOCVM_REMOTE_SIGNATURES
 };
 
-extern map<wstring, uint64_t> allocation_fields;
-
 class GenericEvent {
 public:
     uint8_t type;
@@ -49,6 +43,5 @@ class GenericEvent {
     };
 };
 
-
 VOID report_detection(int detId, GenericEvent evt);
 VOID detect_event(GenericEvent evt);

agent/Helpers.cpp

@@ -1,4 +1,4 @@
-#include "TiMemAgent.h"
+#include "Helpers.h"
 
 // int to hex-string
 std::string itohs(uint64_t i) {
@@ -101,6 +101,19 @@ BOOL agent_message(std::string message) {
     return TRUE;
 }
 
+std::string ftostr(std::string& file_name) {
+    std::ifstream f;
+    std::stringstream ss;
+
+    f.open(file_name);
+
+    if (!f)
+        return "";
+
+    ss << f.rdbuf();
+    return ss.str();
+}
+
 VOID log_debug(const wchar_t* format, ...)
 {
     wchar_t message[512];

agent/Helpers.h

@@ -1,14 +1,16 @@
 #pragma once
-#include "TiMemAgent.h"
-#include <Windows.h>
+#include "TiEtwAgent.h"
+
+using std::string;
 
 #define MAX_BUF_SIZE 2048
 #define MEM_STR_SIZE 512
 
-#define GET_VARIABLE_NAME(Variable) (#Variable)
+string itohs(uint64_t i);
+string ftostr(string &file_name);
+string get_pname(uint64_t pid);
+string dump_memory_ascii(uint64_t pid, uint64_t base_address, int length);
+
+BOOL agent_message(string message);
 
-std::string itohs(uint64_t i);
-std::string get_pname(uint64_t pid);
-std::string dump_memory_ascii(uint64_t pid, uint64_t base_address, int length);
-BOOL agent_message(std::string message);
 VOID log_debug(const wchar_t* format, ...);

agent/TiEtwAgent.cpp

@@ -0,0 +1,196 @@
+#include "TiEtwAgent.h"
+#include "AgentService.h"
+
+DWORD install_elam()
+{
+    DWORD ret{ 0 };
+    WCHAR driverName[]{ DRIVER_NAME };
+    HANDLE hFile{ NULL };
+
+    log_debug(L"TiEtwSensor: Opening driver file: %s\n", driverName);
+
+    hFile = CreateFile(
+        driverName,
+        FILE_READ_DATA,
+        FILE_SHARE_READ,
+        NULL,
+        OPEN_EXISTING,
+        FILE_ATTRIBUTE_NORMAL,
+        NULL
+    );
+
+    if (hFile == INVALID_HANDLE_VALUE) {
+        ret = 1;
+        log_debug(L"TiEtwSensor: Unable to read driver file\n");
+        return ret;
+    }
+
+    if (InstallELAMCertificateInfo(hFile) == FALSE) {
+        ret = 1;
+        log_debug(L"TiEtwSensor: Unable to install ELAM certificate\n");
+        return ret;
+    }
+
+    log_debug(L"TiEtwSensor: ELAM driver has been installed successfully\n");
+    return ret;
+}
+
+DWORD install_agent_service()
+{
+    DWORD ret = 0;
+    SERVICE_LAUNCH_PROTECTED_INFO info;
+    SC_HANDLE hService;
+    SC_HANDLE hSCManager;
+
+    DWORD SCManagerAccess = SC_MANAGER_ALL_ACCESS;
+    hSCManager = OpenSCManager(NULL, NULL, SCManagerAccess);
+
+    if (NULL == hSCManager) {
+        ret = 1;
+        log_debug(L"TiEtwSensor: Unable to open Service Control Manager\n");
+        return ret;
+    }
+
+    wchar_t serviceCmd[MAX_BUF_SIZE]{ 0 };
+
+    GetModuleFileName(
+        NULL, 
+        serviceCmd, 
+        MAX_BUF_SIZE
+    );
+
+    DWORD serviceCmdLen = lstrlenW(serviceCmd);
+    wcscpy_s(serviceCmd + serviceCmdLen, MAX_BUF_SIZE - serviceCmdLen, L" service");
+
+    hService = CreateService(
+        hSCManager,
+        SERVICE_NAME,
+        SERVICE_NAME,
+        SCManagerAccess,
+        SERVICE_WIN32_OWN_PROCESS,
+        SERVICE_DEMAND_START,
+        SERVICE_ERROR_NORMAL,
+        serviceCmd,
+        NULL,
+        NULL,
+        NULL,
+        NULL, 
+        NULL
+    );
+
+    if (NULL == hService) {
+        ret = GetLastError();
+        if (ret == ERROR_SERVICE_EXISTS) {
+            log_debug(L"TiEtwSensor: Service '%s' already exists\n", SERVICE_NAME);
+        }
+        else {
+            log_debug(L"TiEtwSensor: Unable to create new service: %d\n", ret);
+        }
+        return ret;
+    }
+
+    info.dwLaunchProtected = SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHT;
+    if (ChangeServiceConfig2(hService, SERVICE_CONFIG_LAUNCH_PROTECTED, &info) == FALSE) {
+        ret = GetLastError();
+        log_debug(L"TiEtwSensor: Unable to change service config %d\n", ret);
+        return ret;
+    }
+
+    log_debug(L"TiEtwSensor: Service has been installed successfully\n");
+    return ret;
+}
+
+
+DWORD uninstall_agent_service() {
+    DWORD ret = 0;
+    SC_HANDLE hSCManager;
+    SC_HANDLE hService;
+    SERVICE_STATUS_PROCESS ssp;
+    DWORD dwBytesNeeded;
+    log_debug(L"TiEtwSensor: Uninstalling the service\n");
+
+    hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
+
+    if (hSCManager == NULL) {
+        ret = 1;
+        log_debug(L"TiEtwSensor: Couldn't open Service Control Manager %d\n");
+        return ret;
+    }
+
+    hService = OpenService(hSCManager, SERVICE_NAME, SERVICE_ALL_ACCESS);
+
+    if (hService == NULL) {
+        ret = 1;
+        log_debug(L"TiEtwSensor: Couldn't open the service\n");
+        return ret;
+    }
+
+    if (!QueryServiceStatusEx(
+        hService, SC_STATUS_PROCESS_INFO, (LPBYTE)&ssp, sizeof(SERVICE_STATUS_PROCESS), &dwBytesNeeded)) {
+        ret = GetLastError();
+        log_debug(L"TiEtwSensor: Couldn't query the service status: %d\n", ret);
+        return ret;
+    }
+
+    if (ssp.dwCurrentState != SERVICE_STOPPED) {
+        if (!ControlService(hService, SERVICE_CONTROL_STOP, (LPSERVICE_STATUS)&ssp)) {
+            ret = GetLastError();
+            log_debug(L"TiEtwSensor: ControlService(Stop) Error: %d\n", ret);
+            return ret;
+        }
+        if (ssp.dwCurrentState != SERVICE_STOPPED) {
+            Sleep(3000);
+            if (!QueryServiceStatusEx(
+                hService, SC_STATUS_PROCESS_INFO, (LPBYTE)&ssp, sizeof(SERVICE_STATUS_PROCESS), &dwBytesNeeded)) {
+                ret = GetLastError();
+                log_debug(L"TiEtwSensor: QueryServiceStatusEx2 Error: %d\n", ret);
+                return ret;
+            }
+            if (ssp.dwCurrentState != SERVICE_STOPPED) {
+                ret = ssp.dwCurrentState;
+                log_debug(L"TiEtwSensor: Waited but service stull not stopped: %d\n", ret);
+                return ret;
+            }
+        }
+    }
+
+    if (!DeleteService(hService)) {
+        ret = GetLastError();
+        log_debug(L"TiEtwSensor: DeleteService Error: %d\n", ret);
+        return ret;
+    }
+
+    log_debug(L"TiEtwSensor: Deleted Service %s\n", SERVICE_NAME);
+
+    return ret;
+}
+
+int main(INT argc, CHAR** argv)
+{
+    DWORD ret{ 0 };
+
+    if (argc != 2) {
+        log_debug(L"Usage: TiMemAgent.exe ( install | uninstall )\n");
+        ret = 1;
+    }
+    else if (strcmp("install", argv[1]) == 0) {
+        log_debug(L"TiEtwSensor: Installing the Early Launch Anti-Malware drivers\n");
+        ret = install_elam();
+        if (ret == 0) {
+            log_debug(L"TiEtwSensor: Installing the agent service\n");
+            ret = install_agent_service();
+        }
+    }
+    else if (strcmp(argv[1], "service") == 0) {
+        log_debug(L"TiEtwSensor: The service is starting up\n");
+        ret = agent_service_init();
+    }
+    else if (strcmp(argv[1], "uninstall") == 0) {
+        ret = uninstall_agent_service();
+    }
+    else {
+        log_debug(L"TiEtwSensor: Unable to parse commandline\n");
+        ret = 1;
+    }
+    return ret;
+}

agent/TiEtwAgent.h

@@ -0,0 +1,18 @@
+#pragma once
+
+#include <Windows.h>
+#include <iostream>
+#include <map>
+#include <stdio.h>
+#include <fstream>
+#include <string>
+#include <vector>
+#include <algorithm>
+#include <sstream>
+
+#include "Helpers.h"
+
+#define LOG_FNAME L"C:\\Windows\\Temp\\TiEtwAgent.txt"
+#define YARA_ENABLED false
+
+const std::string YARA_RULE_DIR{ "c:\\yara_rules" };