GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → jthuraisamy → Telemetrysourcerer

jthuraisamy / Telemetrysourcerer

Licence: apache-2.0
Enumerate and disable common sources of telemetry used by AV/EDR.

Labels

security-toolsevasion

Projects that are alternatives of or similar to Telemetrysourcerer

W5
Security Orchestration, Automation and Response (SOAR) Platform. 安全编排与自动化响应平台，无需编写代码的安全自动化，使用 SOAR 可以让团队工作更加高效
Stars: ✭ 367 (-8.25%)
Mutual labels:  security-tools
Pyup
A tool to update your project's dependencies on GitHub. Runs on pyup.io, comes with a command line interface.
Stars: ✭ 379 (-5.25%)
Mutual labels:  security-tools
Cerberus
一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能
Stars: ✭ 389 (-2.75%)
Mutual labels:  security-tools
Android Api Securekeys
Store data in a simple and secure way
Stars: ✭ 372 (-7%)
Mutual labels:  security-tools
Apkanalyser
一键提取安卓应用中可能存在的敏感信息。
Stars: ✭ 378 (-5.5%)
Mutual labels:  security-tools
Fwanalyzer
a tool to analyze filesystem images for security
Stars: ✭ 382 (-4.5%)
Mutual labels:  security-tools
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (-9.25%)
Mutual labels:  security-tools
Huskyci
Performing security tests inside your CI
Stars: ✭ 398 (-0.5%)
Mutual labels:  security-tools
Myscan
myscan 被动扫描
Stars: ✭ 373 (-6.75%)
Mutual labels:  security-tools
Race The Web
Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.
Stars: ✭ 385 (-3.75%)
Mutual labels:  security-tools
Offensivedlr
Toolbox containing research notes & PoC code for weaponizing .NET's DLR
Stars: ✭ 364 (-9%)
Mutual labels:  security-tools
Ladongo
Ladon Pentest Scanner framework 全平台LadonGo开源内网渗透扫描器框架，使用它可轻松一键批量探测C段、B段、A段存活主机、高危漏洞检测MS17010、SmbGhost，远程执行SSH/Winrm，密码爆破SMB/SSH/FTP/Mysql/Mssql/Oracle/Winrm/HttpBasic/Redis，端口扫描服务识别PortScan指纹识别/HttpBanner/HttpTitle/TcpBanner/Weblogic/Oxid多网卡主机，端口扫描服务识别PortScan。
Stars: ✭ 366 (-8.5%)
Mutual labels:  security-tools
A Red Teamer Diaries
RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.
Stars: ✭ 382 (-4.5%)
Mutual labels:  security-tools
Aiodnsbrute
Python 3.5+ DNS asynchronous brute force utility
Stars: ✭ 370 (-7.5%)
Mutual labels:  security-tools
Xeexe Topantivirusevasion
Undetectable & Xor encrypting with custom KEY (FUD Metasploit Rat) bypass Top Antivirus like BitDefender,Malwarebytes,Avast,ESET-NOD32,AVG,... & Automatically Add ICON and MANIFEST to excitable
Stars: ✭ 387 (-3.25%)
Mutual labels:  evasion
Spicypass
A light-weight password manager with a focus on simplicity and security
Stars: ✭ 367 (-8.25%)
Mutual labels:  security-tools
Gadgetprobe
Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.
Stars: ✭ 381 (-4.75%)
Mutual labels:  security-tools
Adhrit
Android Security Suite for in-depth reconnaissance and static bytecode analysis based on Ghera benchmarks.
Stars: ✭ 399 (-0.25%)
Mutual labels:  security-tools
Applicationinspector
A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.
Stars: ✭ 3,873 (+868.25%)
Mutual labels:  security-tools
Envizon
network visualization & vulnerability management/reporting
Stars: ✭ 382 (-4.5%)
Mutual labels:  security-tools
View All Similar Projects ➔

Telemetry Sourcerer

Introduction

Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows.

Red teamers and security enthusiasts can use this tool in a lab environment to:

  • Identify collection-based blind spots in the products they're up against.
  • Determine which sources of telemetry generate particular types of events.
  • Validate whether using the tool's tampering capabilities can lead to detection.

For details on building a private lab, consider reading my post on Diverting EDR Telemetry to Private Infrastructure.

OPSEC WARNING: Although it's possible to use this in targeted environments, there are OPSEC risks when using any offensive security tool as is. You can instead leverage the code from this project into your own tooling for operational use and combine with other techniques to reduce the footprint it creates.

Features

  • Enumerates various kernel-mode callbacks with the ability to suppress them.
  • Detects inline user-mode hooks within the process, with the ability to unhook them.
  • Lists ETW sessions and providers while highlighting potentially relevant ones to disable.

Screenshots





Usage Instructions

  1. Download the latest release.
  2. Extract files.
  3. Launch the executable (run elevated for kernel-mode callbacks or more ETW sessions).

Kernel-mode Callbacks

To view kernel-mode callbacks, the tool needs to be run with elevated privileges to load a driver. The driver does not come signed, so consider enabling test signing mode, temporarily disabling driver signature enforcement (DSE), or signing the driver with a valid certificate:

Test Signing Mode

  1. Disable BitLocker and Secure Boot.
  2. Open an elevated Command Prompt window.
  3. Enter bcdedit.exe -set TESTSIGNING ON.
  4. Reboot system.
  5. Launch Telemetry Sourcerer with elevated privileges.

Disable DSE with KDU

  1. git clone https://github.com/hfiref0x/KDU.git
  2. Open an elevated Command Prompt window.
  3. Enter kdu -dse 0 to disable DSE.
  4. Launch Telemetry Sourcerer with elevated privileges.
  5. Enter kdu -dse 6 to enable DSE.

This option may be incompatible with KPP on Windows 8.1+.

Sign Driver

  1. Get SignTool from the Windows SDK and an appropriate cross-certificate from Microsoft Docs.
  2. signtool sign /a /ac "cross-cert.cer" /f "cert.pfx" /p "password" TelemetrySourcererDriver.sys
  3. Launch Telemetry Sourcerer with elevated privileges.

Caveats and Limitations

  • This tool is meant for research purposes only and is not OPSEC-safe for production use.
  • Compiled with Visual Studio 2019 using the Windows 10 SDK (10.0.19041.0) and WDK (2004).
  • Currently does not look for IAT/EAT user-mode hooks, or kernel-mode hooks.
  • The driver has not been thoroughly tested for abuse cases.
  • Tested on Windows 7 and 10 (x64) only.

Credits

This tool was developed by @Jackson_T but builds upon the work of others:

Related Articles and Projects

Licence

This project is licensed under the Apache License 2.0.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].