Technical reference on modern EDR architecture, detection mechanisms, evasion techniques, and reverse-engineering methodology. Covers kernel callback APIs, file-system mini-filters, ETW providers, the four detection-engine model, syscall gates (FreshyCalls, RecycledGate, SysWhispers4, Acheron, Sysplant), sleep obfuscation (Ekko, FOLIAGE, DreamWalkers), call-stack spoofing (SilentMoonwalk, VulcanRaven), ETW-TI hardware-breakpoint bypass, patchless AMSI bypass via VEH, BYOVD against the vulnerable-driver blocklist, and the eight-phase EDR research methodology.

Event Tracing for Windows Threat Intelligence provides EDRs with secure, kernel-level telemetry. In this blog, we reverse engineer undocumented kernel structures and create a precise data-only attack to blind ETW-TI logging.

A technical deep-dive into reverse engineering MmVerifyCallbackFunctionCheckFlags and bypassing STATUS_ACCESS_DENIED for manually mapped drivers in Windows 11.

As described in my Blog post for defenders: Windows ETW (Event Tracing for Windows) - ETW is a crucial system component for EDR/XDR to identify malicious behavior on Windows. Since the post is going into the depth, I recommend to read this post first before you go down the rabbit hole in this post. , blog-description

The battle for the endpoint is won or lost in telemetry. This has been increasingly recognized by the security community, with projects such as EDR Telemetry aiming to systematically compare and improve EDR visibility. , blog-description

Endpoint Detection and Response tools are the closest thing the blue team has to omniscience. They sit inside every process, tap into the kernel, and watch every syscall. And yet red teamers bypass them every day. The fastest way to understand why is to build one yourself, deliberately badly, and then try to break it. That is exactly what MostShittyEDR is: an intentionally vulnerable EDR written in Nim that runs both as a user mode agent and, optionally, with a full kernel driver that provides real time process callbacks, LSASS handle protection, and hardware enforced kill. , blog-description

True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.

A deep dive into ETW providers and how EDRs consume telemetry under the hood.

Tampering with Windows Event Tracing: Background, Offense, and Defense Event Tracing for Windows (ETW) is the mechanism Windows uses to trace and log system events. Attackers often clear event logs …

Evade Microsoft Defender by embedding Lua into Rust: Learn advanced techniques for game modding, language exploration, and stealthy scripting approaches.

Why has Event Tracing for Windows (ETW) become so pivotal for endpoint detection and response (EDR) solutions in Windows 10 and 11? The answer lies in the value of the intelligence it provides to security tools through secure ETW channels, which are now also a target for offensive researchers looking to bypass […] , Why has Event Tracing for Windows (ETW) become so pivotal for endpoint detection and response (EDR) solutions in Windows 10 and 11? The answer lies in the value of the intelligence it provides to security tools through secure ETW channels, which are now also a target for offensive researchers looking to bypass […]

In this article we will see how Windows drivers work, how to create one and, in the end, we will develope a custom EDR that will rely on kernel callback functions, static analysis and API hooking.

Brute Ratel v1.6 codename Reboot is now available for download. This release brings in several updates to existing evasion techniques, support for Windows Commander, Hi-DPI scaling and various heavy user experience updates (QOL) requested by the BRc4 community. A quick summary of the changes can be found in the release notes.

Brute Ratel v1.7 [codename Pandemonium] is now available for download. This release is an entire overhaul of the Badger, Ratel Server and Commander to provide support for Yara evasions and Apple Silicon. Customers using v1.6 release should note that the Badger, Ratel server and Commander of v1.6 will not support v1.7. Do not upgrade to this release if you are in an active engagement. Operators should read this blog or the release notes section to understand the changes before upgrading. A quick summary of changes can be found in the release notes.

Brute Ratel v1.8 [codename Mirage] is now available for download. This release provides a heavy update towards evasion and other feature requests by the community. Customers using v1.7 release should note that the Badgers of v1.7 will not support v1.8. Do not upgrade to this release if you are in an active engagement. Release notes have been disabled from here on out as we’ve noticed that it helps various security solutions to build detection capabilities on them. All blog updates/documentation will only contain minimalistic information on the internals starting from this release. Customers wanting further information can reach out to us on the dedicated email or discord support channel.

Brute Ratel v2.0 [codename Metamorphosis] is now available for download. This release introduces significant changes compared to previous versions, so it’s strongly recommended to review this blog, the private videos, and the documentation before using it. The Badger component has undergone extensive rewrites, featuring major updates in evasion tactics and new functionalities. The server has been optimized for speed and efficiency, with significant improvements to the licensing algorithm, ensuring each license is linked to a specific host to prevent misuse. However, the license can still be transfered from one host to another while deactivating the previous one. Additionally, several minor updates have been made to the Commander, which operators will notice during operation.

Badger doesn’t care. It takes what it wants!

Brute Ratel v2.3 (codename Flux) is now available for download. A key focus of this release was complete redevelopment of the Badger implant using a custom-built compiler, designed to improve operational security (OpSec) and significantly reduce its memory footprint. During development, I noticed several limitations in the existing MinGW and Clang toolchains, particularly in how they handle certain memory regions and stack layouts. To address these issues, the MinGW/Clang compiler provided limited support, as ideally, these are not options that a general developer would ideally want to mess with. But the built-in optimizations were a tad bit problematic when dealing with my stealth requirements. Thus, I ended up creating a tailored variant, capable of optimizing the Badger’s compilation process to meet the required stealth requirements. As a result, the size of the full Badger implant has been reduced by 30% in this release, with further reductions expected to reach around 60% in the next iteration — all while retaining the full feature set.

The article shows how to enumerate Windows process creation callbacks by reading PspCreateProcessNotifyRoutine from kernel memory using a BYOVD read primitive and mapping callbacks to drivers.

Coding Windows Kernel Driver - InjectAll - Making the Visual Studio solution for DLL injection into all running processes.

Because anti-virus softwares were hardhooking the Windows kernel to intercept WinAPI calls when processes were opening files and stuff, Microsoft implemented official and supported methods for receiving notifications for certain events and acting on them. \xa0For instance, when a user launches an executable file, an anti-virus software can be alerted and can scan the file…

Stop building labs by hand. Automate the deployment of a fully instrumented Purple Team range using Ludus and Elastic Security. Spin up infrastructure, execute attacks, and validate detection rules in a single, repeatable workflow.

With Elastic Security 8.11, we added further kernel telemetry call stack-based detections to increase efficacy against in-memory threats.

This research focuses on the importance of native audit logs in secure-by-design software, emphasizing the need for kernel-level ETW logging over user-mode hooks to enhance anti-tamper protections.

We aim to out-innovate adversaries and maintain protections against the cutting edge of attacker tradecraft. With Elastic Security 8.8, we added new kernel call stack based detections which provide us with improved efficacy against in-memory threats.

Explore effective ransomware detection strategies in Sanctum EDR, leveraging Windows minifilter drivers to identify ransomware activity in real-time.

Learn how VEH² uses hardware breakpoints to bypass security routines, and how a Rust-based Windows kernel EDR can detect debug-register tampering by enumerating threads and inspecting their CONTEXT.

Discover a theory-driven approach to detect Early Bird APC Queue Injection bypasses and kernel-mode improvements to Ghost Hunting within the Sanctum EDR framework.

Implementing a syscall hook for VirtualAllocEx in Rust to track remote memory allocations. Learn how EDRs monitor process injections using Windows API hooks.

Explore advanced EDR syscall hooking strategies, kernel-level callbacks, and a new “Ghost Hunting” concept. Learn how Sanctum EDR intercepts malicious injection attempts through a layered defense approach.

Learn how to implement an ETW Threat Intelligence consumer in Rust to detect malware activities like remote memory allocation, APC injection, and process suspension. Enhance your EDR with kernel-level telemetry.

Explore advanced, low-level techniques for detecting ETW tampering in Windows kernel. Learn how Sanctum EDR counters rootkit attacks with cutting-edge kernel-level monitoring.

Learn how the Ghost Hunting technique detects malware abusing OpenProcess by tracking syscall hooks and kernel events in real-time. Explore Rust-based EDR development and see how this approach enhances detection capabilities.

Learn how to implement syscall hooking in Rust with a detailed walkthrough, from DLL injection and syscall resolution to modifying execution flow. This post explores low-level Windows internals, kernel callbacks, and inline assembly techniques for EDR development.

Documenting changes to the way in which the Sanctum EDR DLL is injected into newly created processes.

Learn how to detect in-memory patching of NTDLL and ETW bypass techniques in a Rust-based EDR. Deep dive into PE headers, pointer arithmetic, and integrity monitoring.

Learn how to reverse engineer Windows 11 kernel internals, uncover undocumented features, and enhance EDR telemetry using Rust.

A tutorial showing you how to get started with Windows Driver Development in Rust.

Discover the project plan for building Sanctum, an open-source EDR in Rust. Learn about the features, milestones, and challenges in developing an effective EDR and AV system.

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust. - 0xflux/Sanctum

Powerful Kernel Malware Investigation Platform | Software Analysis & Threat Hunting - GitHub - 8damon/Blackbird: Powerful Kernel Malware Investigation Platform | Software Analysis & Threat Hunting

Live ETW-TI event viewer for Windows kernel threat-intelligence telemetry. Research tool for exploring the same signals commercial EDRs rely on. - GitHub - adanto/EtwTiViewer: Live ETW-TI event viewer for Windows kernel threat-intelligence telemetry. Research tool for exploring the same signals commercial EDRs rely on.

Contribute to AlloySecureGroup/BlinkLinkSentiennel development by creating an account on GitHub.

Contribute to BenjiTrapp/MostShittyAV development by creating an account on GitHub.

Simple EDR implementation to demonstrate bypass. Contribute to CCob/SylantStrike development by creating an account on GitHub.

Open EDR public repository. Contribute to ComodoSecurity/openedr development by creating an account on GitHub.

Tutorial & a blog post that demonstrate how to code a Windows driver to inject a custom DLL into all running processes. I coded it from start to finish using C++ and x86/x64 Assembly language in Microsoft Visual Studio. The solution includes a kernel driver project, a DLL project and a C++ test console project. - dennisbabkin/InjectAll

Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks. - Dor00tkit/BamExtensionTableHook

Detection of indirect syscall techniques using hardware breakpoints and vectored exception handling. - EvilBytecode/Detecting-Indirect-Syscalls

Deep insights into EDR detection approaches. Contribute to evilele/EDR-Introspection development by creating an account on GitHub.

Overview of MS Defender . Contribute to HackingLZ/defender_overview development by creating an account on GitHub.

MAPS cloud scanner and response parser for Microsoft Defender research. - HackingLZ/maps_scanner

Simulate the behavior of AV/EDR for malware development training. - Helixo32/CrimsonEDR

Capability extraction from Time Travel Debugging Traces - HullaBrian/ttd-capa

Windows native ETW inspection suite for browsing providers, reading metadata, consuming live events, recording ETL traces, filtering results, and inspecting ETL/JSON/CSV recordings from one desktop tool. - Idov31/EtwSuite

Uses ghidra to find all ETW write metadata for each API in a PE file - jdu2600/API-To-ETW

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions - jdu2600/CFG-FindHiddenShellcode

Monitors ETW for security relevant syscalls maintaining the set called by each unique process - jdu2600/Etw-SyscallMonitor

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections - jdu2600/EtwTi-FluctuationMonitor

Events from all manifest-based and mof-based ETW providers across Windows 10 versions - jdu2600/Windows10EtwEvents

Contribute to jonny-jhnson/ETWInspector development by creating an account on GitHub.

Contribute to jonny-jhnson/JonMon-Lite development by creating an account on GitHub.

Contribute to jonny-jhnson/JonMon development by creating an account on GitHub.

Contribute to jonny-jhnson/TelemetrySource development by creating an account on GitHub.

Contribute to jonny-jhnson/TelemetrySource development by creating an account on GitHub.

Contribute to jonny-jhnson/JonMon development by creating an account on GitHub.

Contribute to jonny-jhnson/Presentations development by creating an account on GitHub.

Contribute to jonny-jhnson/TelemetrySource development by creating an account on GitHub.

Set of PoC to abuse Windows minifilters functionality - Kudaes/Puzzle

Contribute to mandiant/SilkETW development by creating an account on GitHub.

Contribute to MazX0p/CobaltSentry development by creating an account on GitHub.

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions. - microsoft/krabsetw

Multi-EDR & SIEM mock server. SentinelOne, CrowdStrike, Defender, Elastic, Cortex XDR, Splunk, M365 and Sentinel — 8 platforms in one process. Real API paths, real auth, deterministic seed data, fault injection, scenario engine, SPL parser. GitHub Action + one-click Render deploy. BSL-1.1 - mockdr/mockdr

Windows Analysis and Research Toolkit. Contribute to mrT4ntr4/NtWarden development by creating an account on GitHub.

Event Tracing For Windows (ETW) Resources. Contribute to nasbench/EVTX-ETW-Resources development by creating an account on GitHub.

Event Tracing For Windows (ETW) Resources. Contribute to nasbench/EVTX-ETW-Resources development by creating an account on GitHub.

A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows registry. - olafhartong/ETWLocksmith

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces. - pandaadir05/ghost

Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider - pathtofile/SealighterTI

Demonstrates consuming from a SecurityTrace ETW session by consuming from the Threat-Intelligence ETW provider without a driver or PPL privilege - preludeorg/ThreatIntelligenceConsumer

Adversary tradecraft detection, protection, and hunting - GitHub - rabbitstack/fibratus: Adversary tradecraft detection, protection, and hunting

Document ETW providers. Contribute to repnz/etw-providers-docs development by creating an account on GitHub.

EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies - sbousseaden/EDRUnChoker

Contribute to sensepost/mydumbedr development by creating an account on GitHub.

Aims to identify sleeping beacons. Contribute to thefLink/Hunt-Sleeping-Beacons development by creating an account on GitHub.

Small tool to play with IOCs caused by Imageload events - thefLink/Hunt-Weird-ImageLoads

ETW based POC to identify direct and indirect syscalls - thefLink/Hunt-Weird-Syscalls

TrustedSec Sysinternals Sysmon Community Guide. Contribute to trustedsec/SysmonCommunityGuide development by creating an account on GitHub.

TrustedSec Sysinternals Sysmon Community Guide. Contribute to trustedsec/SysmonCommunityGuide development by creating an account on GitHub.

TrustedSec Sysinternals Sysmon Community Guide. Contribute to trustedsec/SysmonCommunityGuide development by creating an account on GitHub.

TrustedSec Sysinternals Sysmon Community Guide. Contribute to trustedsec/SysmonCommunityGuide development by creating an account on GitHub.

A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server. - TwoSevenOneT/EDRChoker

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. - wazuh/wazuh

proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC - wbenny/injdrv

Intel 64/Windows low-level experiments. Contribute to winterknife/EVENSTAR development by creating an account on GitHub.

EDR Lab for Experimentation Purposes. Contribute to Xacone/BestEdrOfTheMarket development by creating an account on GitHub.

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes - xuanxuan0/TiEtwAgent

A low-level EDR tool built in C++ that catches injected DLLs using the Windows Debugging API, implements inline API hooking (including LdrLoadDll and MessageBoxA), and stops threats safely by patching entry points with a ret. - zyv2/My_Custom_EDR

<p>Hello, this is banda. This is my first time greeting you with an article on Windows Minifilter Drivers. &#x1F917;</p> <p>While studying Windows Kernel Drivers recently, I discovered that there are various types of drivers categorized by purpose, such as Bus Drivers, Filter Drivers, FSDs, and Minifilters. I became curious about the structural differences between Bus or Filter Drivers and traditional Function Drivers, as well as how vulnerabilities manifest in these different types.</p> <p>Today, we will explore the structure and operation of Minifilter Drivers, examine their internal components, and analyze potential vulnerabilities.</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image1.png" alt></p> <h1 id="1-About-Minifilter-Drivers"><a href="#1-About-Minifilter-Drivers" class="headerlink" title="1. About Minifilter Drivers"></a>1. About Minifilter Drivers</h1><hr> <p>A Minifilter driver is a specialized type of driver in Windows designed to monitor, intercept, and modify file system I/O requests such as file creation, opening, reading, writing, and deletion. It is commonly used for precise monitoring of file system activity.</p> <p>If you think about it in terms of <strong>&#x201C;monitoring, blocking, or modifying file access&#x201D;</strong>, it starts to sound familiar, doesn&#x2019;t it? Indeed &#x2014; this functionality is well-suited for products like <strong>antivirus software, EDR solutions, and backup programs</strong>. In fact, I&#x2019;ve personally confirmed that many such products rely on Minifilter drivers.</p> <p>A Minifilter driver can intercept or manipulate the following three types of requests:</p> <ol> <li>IRP (I/O Request Packet)</li> <li>Fast I/O</li> <li>File System Filter Callbacks</li> </ol> <h2 id="1-1-Filter-Manager-&#x2192;-Minifilter-Flow"><a href="#1-1-Filter-Manager-&#x2192;-Minifilter-Flow" class="headerlink" title="1.1 Filter Manager &#x2192; Minifilter Flow"></a>1.1 Filter Manager &#x2192; Minifilter Flow</h2><p>A Minifilter operates on top of the Windows Filter Manager (<code>fltmgr.sys</code>). The Filter Manager receives file I/O requests from the I/O Manager and forwards them to the registered Minifilter drivers in the order determined by their <strong>altitude</strong>. In other words, the altitude controls the order in which filters are loaded and invoked.</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image2.gif" alt></p> <p>Let&#x2019;s take a look at how file I/O requests are processed in Windows.</p> <ol> <li>An application issues an I/O operation by calling APIs such as <code>CreateFile</code>, <code>ReadFile</code>, or <code>WriteFile</code>.</li> <li>The I/O Manager receives this request and forwards it to the Filter Manager (<code>fltmgr.sys</code>).</li> <li>The Filter Manager checks the list of all registered Minifilter drivers and passes the request to each driver in the order of their altitude.</li> <li>After the Minifilter completes its processing, the request is passed on to the file system filter driver.</li> <li>Finally, the request is delivered to the disk driver (Storage Driver Stack), which accesses the physical disk or processes the data accordingly.</li> </ol> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image3.png" alt></p> <p>You can check the list of Minifilter drivers loaded on the system by running the <code>fltmc</code> command in the Command Prompt.</p> <p>The higher the altitude value, the higher the priority, meaning the Minifilter can intercept or modify I/O requests earlier. However, the processing order differs depending on whether it is a pre-operation or post-operation callback.</p> <ul> <li><strong>Pre-operation</strong>: Called in <strong>descending altitude order</strong> (high &#x2192; low)</li> <li><strong>Post-operation</strong>: Called in <strong>ascending altitude order</strong> (low &#x2192; high)</li> </ul> <p>Looking back at the overall flow&#x2026; a Minifilter driver does not directly handle IRPs in the traditional way.</p> <p>Instead, the Filter Manager receives I/O requests on its behalf and passes them to the Minifilter through callback functions.</p> <p>In other words, a Minifilter driver does <strong>not</strong> need to set up the <strong>DispatchRoutine</strong> that we commonly associate with traditional drivers!</p> <h2 id="1-2-Minifilter-Callback-Routine"><a href="#1-2-Minifilter-Callback-Routine" class="headerlink" title="1.2 Minifilter Callback Routine"></a>1.2 Minifilter Callback Routine</h2><p>How can a Minifilter driver operate only on specific file operations?</p> <p>This is possible thanks to a mechanism called <strong>callbacks</strong>.</p> <p>As mentioned earlier, a Minifilter driver does <strong>not</strong> directly process IRPs through a <code>DispatchRoutine</code>.</p> <p>Instead, it can &#x201C;hook&#x201D; I/O requests delivered via the Filter Manager.</p> <p>By registering <strong>pre-operation (<code>PreOperation Callback</code>)</strong> and <strong>post-operation (<code>PostOperation Callback</code>)</strong> callbacks, a Minifilter can monitor or control I/O operations at the system level when they occur.</p> <ul> <li><strong>Pre-operation callback (<code>PFLT_PRE_OPERATION_CALLBACK</code>)</strong></li> </ul> <pre><code class="hljs c">PFLT_PRE_OPERATION_CALLBACK PfltPreOperationCallback; <span class="hljs-function">FLT_PREOP_CALLBACK_STATUS <span class="hljs-title">PfltPreOperationCallback</span><span class="hljs-params">(</span></span> <span class="hljs-function"><span class="hljs-params"> [in, out] PFLT_CALLBACK_DATA Data,</span></span> <span class="hljs-function"><span class="hljs-params"> [in] PCFLT_RELATED_OBJECTS FltObjects,</span></span> <span class="hljs-function"><span class="hljs-params"> [out] PVOID *CompletionContext</span></span> <span class="hljs-function"><span class="hljs-params">)</span></span> <span class="hljs-function"></span>{...}</code></pre> <p>Called before the I/O request is passed to the file system or lower drivers.</p> <p>This is where the core logic of the Minifilter runs, with powerful capabilities such as returning</p> <p><code>FLT_PREOP_COMPLETE</code>, <code>FLT_PREOP_SUCCESS_WITH_CALLBACK</code>, or <code>FLT_PREOP_SUCCESS_NO_CALLBACK</code>.</p> <p><a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nc-fltkernel-pflt_pre_operation_callback"><strong>PFLT_PRE_OPERATION_CALLBACK callback function (fltkernel.h)</strong></a></p> <ul> <li><strong>Post-operation callback (<code>PFLT_POST_OPERATION_CALLBACK</code>)</strong></li> </ul> <pre><code class="hljs c">PFLT_POST_OPERATION_CALLBACK PfltPostOperationCallback; <span class="hljs-function">FLT_POSTOP_CALLBACK_STATUS <span class="hljs-title">PfltPostOperationCallback</span><span class="hljs-params">(</span></span> <span class="hljs-function"><span class="hljs-params"> [in, out] PFLT_CALLBACK_DATA Data,</span></span> <span class="hljs-function"><span class="hljs-params"> [in] PCFLT_RELATED_OBJECTS FltObjects,</span></span> <span class="hljs-function"><span class="hljs-params"> [in, optional] PVOID CompletionContext,</span></span> <span class="hljs-function"><span class="hljs-params"> [in] FLT_POST_OPERATION_FLAGS Flags</span></span> <span class="hljs-function"><span class="hljs-params">)</span></span> <span class="hljs-function"></span>{...}</code></pre> <p>Called on the way back after the I/O request has been fully processed by lower drivers and the file system.</p> <p>It is typically used to verify the success of the operation, log results, or modify the outcome if needed.</p> <p><a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nc-fltkernel-pflt_post_operation_callback"><strong>PFLT_POST_OPERATION_CALLBACK callback function (fltkernel.h)</strong></a></p> <p>In short, these callbacks are registered in the <code>FLT_OPERATION_REGISTRATION</code> structure, which specifies <strong>which pre-/post-operation callbacks are associated with which I/O operations (MajorFunctions)</strong>.</p> <hr> <h2 id="1-3-Communication-Between-Minifilter-and-User-Mode"><a href="#1-3-Communication-Between-Minifilter-and-User-Mode" class="headerlink" title="1.3 Communication Between Minifilter and User-Mode"></a>1.3 Communication Between Minifilter and User-Mode</h2><p>Communication between a Minifilter driver and a User-Mode application is handled via a <strong>filter communication port</strong>.</p> <p>This port acts as a dedicated high-speed communication channel between the Minifilter and the application, allowing safe message exchange between Kernel-Mode drivers and User-Mode processes.</p> <p>Let&#x2019;s look into the code and explore the APIs provided by Microsoft for this purpose.</p> <h3 id="Driver-Code"><a href="#Driver-Code" class="headerlink" title="Driver Code"></a>Driver Code</h3><pre><code class="hljs c"><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;fltKernel.h&gt;</span></span> PFLT_FILTER gFilter = <span class="hljs-literal">NULL</span>; PFLT_PORT gServerPort = <span class="hljs-literal">NULL</span>, gClientPort = <span class="hljs-literal">NULL</span>; <span class="hljs-function">VOID <span class="hljs-title">OnDisconnect</span><span class="hljs-params">(PVOID Cookie)</span> </span>{ UNREFERENCED_PARAMETER(Cookie); FltCloseClientPort(gFilter, &amp;gClientPort); gClientPort = <span class="hljs-literal">NULL</span>; } <span class="hljs-function">NTSTATUS <span class="hljs-title">OnConnect</span><span class="hljs-params">(PFLT_PORT ClientPort, PVOID SrvCookie, PVOID Ctx, ULONG Size, PVOID* ConnCookie)</span> </span>{ UNREFERENCED_PARAMETER(SrvCookie); UNREFERENCED_PARAMETER(Ctx); UNREFERENCED_PARAMETER(Size); UNREFERENCED_PARAMETER(ConnCookie); gClientPort = ClientPort; <span class="hljs-keyword">return</span> STATUS_SUCCESS; } <span class="hljs-function">FLT_PREOP_CALLBACK_STATUS <span class="hljs-title">PreCreate</span><span class="hljs-params">(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID* Buff)</span> </span>{ UNREFERENCED_PARAMETER(FltObjects); UNREFERENCED_PARAMETER(Buff); PFLT_FILE_NAME_INFORMATION nameInfo; <span class="hljs-keyword">if</span> (gClientPort &amp;&amp; NT_SUCCESS(FltGetFileNameInformation(Data, FLT_FILE_NAME_NORMALIZED, &amp;nameInfo))) { FltSendMessage(gFilter, &amp;gClientPort, nameInfo-&gt;Name.Buffer, nameInfo-&gt;Name.Length, <span class="hljs-literal">NULL</span>, <span class="hljs-literal">NULL</span>, <span class="hljs-literal">NULL</span>); FltReleaseFileNameInformation(nameInfo); } <span class="hljs-keyword">return</span> FLT_PREOP_SUCCESS_NO_CALLBACK; } <span class="hljs-function">NTSTATUS <span class="hljs-title">Unload</span><span class="hljs-params">(FLT_FILTER_UNLOAD_FLAGS Flags)</span> </span>{ UNREFERENCED_PARAMETER(Flags); FltCloseCommunicationPort(gServerPort); FltUnregisterFilter(gFilter); <span class="hljs-keyword">return</span> STATUS_SUCCESS; } <span class="hljs-function">NTSTATUS <span class="hljs-title">DriverEntry</span><span class="hljs-params">(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)</span> </span>{ UNREFERENCED_PARAMETER(RegistryPath); NTSTATUS status; <span class="hljs-keyword">const</span> FLT_OPERATION_REGISTRATION Cbs[] = { { IRP_MJ_CREATE, <span class="hljs-number">0</span>, PreCreate, <span class="hljs-literal">NULL</span> }, { IRP_MJ_OPERATION_END } }; <span class="hljs-keyword">const</span> FLT_REGISTRATION Reg = { <span class="hljs-keyword">sizeof</span>(FLT_REGISTRATION), FLT_REGISTRATION_VERSION, <span class="hljs-number">0</span>, <span class="hljs-literal">NULL</span>, Cbs, Unload }; status = FltRegisterFilter(DriverObject, &amp;Reg, &amp;gFilter); <span class="hljs-keyword">if</span> (!NT_SUCCESS(status)) <span class="hljs-keyword">return</span> status; UNICODE_STRING portName = RTL_CONSTANT_STRING(<span class="hljs-string">L&quot;\\FileActivityMonitorPort&quot;</span>); OBJECT_ATTRIBUTES oa = { <span class="hljs-keyword">sizeof</span>(oa), <span class="hljs-literal">NULL</span>, &amp;portName, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, <span class="hljs-literal">NULL</span> }; status = FltCreateCommunicationPort(gFilter, &amp;gServerPort, &amp;oa, <span class="hljs-literal">NULL</span>, OnConnect, OnDisconnect, <span class="hljs-literal">NULL</span>, <span class="hljs-number">1</span>); <span class="hljs-keyword">if</span> (!NT_SUCCESS(status)) { FltUnregisterFilter(gFilter); <span class="hljs-keyword">return</span> status; } <span class="hljs-keyword">return</span> FltStartFiltering(gFilter); }</code></pre> <p>Focusing on the representative driver code APIs <code>FltCreateCommunicationPort()</code>, <code>FltSendMessage()</code>, and <code>FltCloseCommunicationPort()</code>, I have implemented an example Minifilter driver code.</p> <p>Let&#x2019;s walk through the flow together:</p> <ol> <li><p>The driver registers itself using <code>FltRegisterFilter()</code>.</p> <p> At this stage, it specifies a <strong>PreCreateCallback</strong> function to monitor file creation and open (<code>IRP_MJ_CREATE</code>) requests, and starts I/O monitoring with <code>FltStartFiltering()</code>.</p> </li> <li><p>Using the <code>FltCreateCommunicationPort()</code> function, the driver can create a communication port.</p> <p> In the code above, it creates the port <code>\\FileActivityMonitorPort</code>, which allows a User-Mode application to connect and receive notifications.</p> </li> <li><p>When a file create/open event occurs, <strong>PreCreateCallback</strong> is invoked, and the function collects information about which process accessed which file.</p> </li> <li>The driver then uses <code>FltSendMessage()</code> to immediately send the real-time file access information collected in <strong>PreCreateCallback</strong> to the connected User-Mode application.</li> <li>Finally, in the <strong>FilterUnload</strong> routine, when the driver is unloaded, it closes the communication port with <code>FltCloseCommunicationPort()</code> and unregisters the filter.</li> </ol> <h3 id="User-Mode-Application-Code"><a href="#User-Mode-Application-Code" class="headerlink" title="User-Mode Application Code"></a>User-Mode Application Code</h3><pre><code class="hljs c"><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;windows.h&gt;</span></span> <span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;fltuser.h&gt;</span></span> <span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;stdio.h&gt;</span></span> <span class="hljs-meta">#<span class="hljs-meta-keyword">pragma</span> comment(lib, <span class="hljs-meta-string">&quot;fltlib.lib&quot;</span>)</span> <span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">main</span><span class="hljs-params">()</span> </span>{ HANDLE port; HRESULT hr; BYTE buffer[<span class="hljs-keyword">sizeof</span>(FILTER_MESSAGE_HEADER) + <span class="hljs-number">1024</span>]; PFILTER_MESSAGE_HEADER header = (PFILTER_MESSAGE_HEADER)buffer; <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Connecting to driver...\n&quot;</span>); hr = FilterConnectCommunicationPort(<span class="hljs-string">L&quot;\\FileActivityMonitorPort&quot;</span>, <span class="hljs-number">0</span>, <span class="hljs-literal">NULL</span>, <span class="hljs-number">0</span>, <span class="hljs-literal">NULL</span>, &amp;port); <span class="hljs-keyword">if</span> (IS_ERROR(hr)) { <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Connection failed. Error 0x%X\n&quot;</span>, hr); <span class="hljs-keyword">return</span> <span class="hljs-number">1</span>; } <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Connected. Waiting for file events...\n&quot;</span>); <span class="hljs-keyword">while</span> (TRUE) { hr = FilterGetMessage(port, header, <span class="hljs-keyword">sizeof</span>(buffer), <span class="hljs-literal">NULL</span>); <span class="hljs-keyword">if</span> (SUCCEEDED(hr)) { <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;File Accessed: %S\n&quot;</span>, (PWSTR)header-&gt;MessageBody); } <span class="hljs-keyword">else</span> { <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Connection lost. Error 0x%X\n&quot;</span>, hr); <span class="hljs-keyword">break</span>; } } CloseHandle(port); <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>; }</code></pre> <p>Let&#x2019;s now look at the communication flow from the User-Mode application side.</p> <p>Representative APIs include <code>FilterConnectCommunicationPort()</code> and <code>FilterSendMessage()</code>.</p> <ol> <li>First, the application uses <code>FilterConnectCommunicationPort()</code> to connect to the Minifilter driver&#x2019;s communication port in the kernel, <code>\\FileActivityMonitorPort</code>, and obtains a HANDLE for communication.</li> <li><p>It then calls <code>FilterGetMessage()</code> to directly receive the file path string from the driver.</p> <p> If the message is received successfully, the application outputs the file path to the screen.</p> </li> </ol> <h1 id="2-CVE-2024-30085-1-Day-Analysis"><a href="#2-CVE-2024-30085-1-Day-Analysis" class="headerlink" title="2. [CVE-2024-30085] 1-Day Analysis"></a>2. [CVE-2024-30085] 1-Day Analysis</h1><hr> <p>This is a Windows Minifilter Driver vulnerability that was also introduced in &#x201C;1day1line&#x201D; (<a href="https://hackyboiz.github.io/2025/01/11/OUYA77/2025-01-11/">reference</a>).</p> <p>Let&#x2019;s try to reproduce CVE-2024-30085 and, in the process, learn more about Minifilter drivers.</p> <blockquote> <p>&#x1FA9F; Environment: Windows 11 22H2/23H2 10.0.2261.3672</p> </blockquote> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image4.png" alt></p> <p>The Windows Cloud Files Mini Filter driver is responsible for the Windows cloud sync feature.</p> <p>For example, I&#x2019;ve taken a screenshot of one of my folders.</p> <p>To understand this Minifilter driver vulnerability, we first need some background knowledge about Stub Files and Reparse Points.</p> <h3 id="What-is-a-Stub-File"><a href="#What-is-a-Stub-File" class="headerlink" title="What is a Stub File?"></a>What is a Stub File?</h3><p>A stub file refers to a file that exists only as a placeholder locally, without containing any actual data.</p> <p>As shown in the image above, the &#x201C;Pictures&#x201D; folder has a blue cloud icon in its status &#x2014; this indicates that the file is in a stub state.</p> <p>On NTFS, its size, name, and icon are displayed, but its actual contents are not stored locally.</p> <h3 id="Reparse-Point-Metadata"><a href="#Reparse-Point-Metadata" class="headerlink" title="Reparse Point Metadata"></a>Reparse Point Metadata</h3><p>So, what happens when a user tries to access such a file?</p> <p>NTFS checks the Reparse Tag and determines, <strong>&#x201C;Oh&#x2026; this is a stub file!&#x201D;</strong>.</p> <p>At this point, the Windows Cloud Files Minifilter (<code>cldflt.sys</code>) reads the <code>Reparse Point</code> metadata structure and decides how to handle the file.</p> <p>After that, the Minifilter prepares for communication with the remote server.</p> <p>However, <code>cldflt.sys</code> itself does not communicate directly with the server &#x2014; instead, it delegates the actual work to a User-Mode process.</p> <p>This matches the concept we saw earlier: the Minifilter plays the role of an I/O interpreter, while the User-Mode client handles the actual data manipulation.</p> <p>I&#x2019;ve added the Windows Cloud Files Minifilter&#x2019;s Reparse Point structure definitions to Local Types.</p> <p>Let&#x2019;s take a look at the CldFlt structure set I defined.</p> <pre><code class="hljs c"><span class="hljs-keyword">typedef</span> <span class="hljs-class"><span class="hljs-keyword">struct</span> _<span class="hljs-title">REPARSE_DATA_BUFFER</span> {</span> DWORD ReparseTag; WORD ReparseDataLength; WORD Reserved; WORD Flags; WORD UncompressedSize; REPARSE_CLD_BUFFER ReparseCldBuffer; } REPARSE_DATA_BUFFER, *PREPARSE_DATA_BUFFER;</code></pre> <p><code>REPARSE_DATA_BUFFER</code> is the standard header structure used to represent all Reparse Point data on NTFS.</p> <p>Here, however, we use a redefined version to make analyzing Cloud Files easier.</p> <p>This structure stores top-level metadata such as <code>ReparseTag</code> (to identify the owning driver), <code>ReparseDataLength</code>, and <code>Flags</code>, and then points to the actual data, which continues as an <code>HSM_REPARSE</code> structure.</p> <pre><code class="hljs c"><span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">HSM_REPARSE</span> {</span> USHORT hsmFlags; USHORT hsmSize; <span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">HSM_RP_DATA</span> <span class="hljs-title">fileData</span>;</span> };</code></pre> <p><code>HSM_REPARSE</code> is the full container for a Cloud Files-specific Reparse Point.</p> <p><code>hsmFlags</code> and <code>hsmSize</code> indicate whether compression is used and the total size of the HSM block.</p> <p>The <code>fileData</code> field contains an <code>HSM_RP_DATA</code> structure.</p> <pre><code class="hljs c"><span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">HSM_RP_DATA</span> {</span> ULONG magic; ULONG crc32; ULONG totalSize; USHORT dataFlags; USHORT elemCount; <span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">HSM_RP_ELEMENT</span> <span class="hljs-title">elements</span>[5];</span> };</code></pre> <p><code>HSM_RP_DATA</code> is the main header, containing the layout and structure of the entire metadata block.</p> <p><code>magic</code> identifies the data type, and if the CRC bit is set in <code>dataFlags</code>, <code>crc32</code> is validated using <code>RtlComputeCrc32</code>.</p> <p>The <code>elements[]</code> array stores <code>HSM_RP_ELEMENT</code> structures that define the type, size, and offset of each metadata element.</p> <pre><code class="hljs c"><span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">HSM_RP_ELEMENT</span> {</span> USHORT elemType; USHORT elemSize; ULONG elemOffset; }; <span class="hljs-keyword">typedef</span> <span class="hljs-keyword">enum</span> HSM_RP_ELEM_TYPE { HSM_RP_ELEMENT_NONE = <span class="hljs-number">0x00</span>, HSM_RP_ELEMENT_U64 = <span class="hljs-number">0x06</span>, HSM_RP_ELEMENT_BYTE = <span class="hljs-number">0x07</span>, HSM_RP_ELEMENT_U32 = <span class="hljs-number">0x0a</span>, HSM_RP_ELEMENT_BITMAP = <span class="hljs-number">0x11</span>, HSM_RP_ELEMENT_MAX = <span class="hljs-number">0x12</span> } HSM_RP_ELEMENT_TYPE;</code></pre> <p><code>HSM_RP_ELEMENT</code> defines each individual metadata element&#x2019;s type, size, and offset.</p> <p>The <code>HSM_RP_ELEMENT_TYPE</code> enumeration is used to classify element types.</p> <h2 id="2-1-Root-Cause-Analysis"><a href="#2-1-Root-Cause-Analysis" class="headerlink" title="2.1 Root Cause Analysis"></a>2.1 Root Cause Analysis</h2><p><img src="/2025/08/15/banda/Minifilter-Driver/en/image5.png" alt></p> <p>The vulnerability occurs when a file is created and the <code>HsmFltPostCREATE</code> callback is executed to process the file&#x2019;s Reparse Point.</p> <p>Within <code>HsmFltPostCREATE</code>, when handling the bitmap information stored in the Reparse Point, the function <code>HsmIBitmapNORMALOpen()</code> is called &#x2014; and this is where the flaw exists.</p> <ul> <li><code>bitmap_size</code> is read directly from the User-Mode request buffer.</li> <li>A fixed-size buffer of 0x1000 bytes is allocated via <code>ExAllocatePoolWithTag</code>, but the user-controlled <code>bitmap_size</code> value is passed directly to <code>memmove</code> without any boundary checks.</li> </ul> <p>Therefore, if <code>bitmap_size</code> is greater than 0x1000, a Heap-based Buffer Overflow is expected to occur.</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image6.png" alt></p> <p>Looking at the <code>HsmpBitmapIsReparseBufferSupported()</code> function, it returns an error if <code>hdr-&gt;elements[4].elemSize</code> is greater than <code>0x1000</code>.</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image7.png" alt></p> <p>Looking a bit further up at the conditional statement code, we can see that <code>hdr-&gt;elements[2]</code> is being strictly validated. Checks such as <code>total &#x2265; 0x18</code> and <code>hdr-&gt;elemCount</code> boundary verification must all be passed in order to proceed. If these conditions are not met, it would return a failure, right?</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image8.png" alt></p> <p>However, in the same function, if <code>hasBuf</code> is set to <code>false</code>, the code returns <code>result = 0</code> (success) simply by checking the 1-byte flag of <code>element[1]</code>, without performing any separate bitmap length validation. In this path, there is no check to determine whether the bitmap length exceeds <code>0x1000</code>, so the validation is skipped and the data is treated as valid.</p> <h2 id="2-2-Exploit"><a href="#2-2-Exploit" class="headerlink" title="2.2 Exploit"></a>2.2 Exploit</h2><p><img src="/2025/08/15/banda/Minifilter-Driver/en/image9.png" alt></p> <p>The <code>cldflt.sys</code> minifilter driver does not scan all file system I/O by default; instead, it only operates on paths within the Sync Root that are registered through the CfAPI. Therefore, the first step was to reach the root directory of a cloud sync folder by calling the <code>CfRegisterSyncRoot()</code> function.</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image10.png" alt></p> <p>Once the Sync Root registration code is built and executed, such a folder is created. Inside this folder, cloud stub files and metadata may appear, and this becomes the point I can exploit.</p> <pre><code class="hljs c">-&gt; HsmFltPostCREATE() -&gt; HsmiFltPostECPCREATE() -&gt; HsmpSetupContexts() -&gt; HsmpCtxCreateStreamContext() -&gt; HsmIBitmapNORMALOpen() </code></pre> <p>Through dynamic analysis, it was confirmed that in order to reach the vulnerable function <code>HsmIBitmapNORMALOpen()</code>, the execution must sequentially pass through the above function chain and satisfy all conditional checks. My goal, therefore, is to fulfill all those conditions and reach the vulnerable <code>memmove</code> inside <code>HsmIBitmapNORMALOpen()</code>.</p> <blockquote> <p>Understanding the Flow as a Minifilter Driver</p> </blockquote> <p>Earlier, I mentioned that a minifilter driver calls specific callbacks depending on the IRP code when an I/O request occurs. To enter the vulnerable path, the process must begin at the <code>IRP_MJ_CREATE</code> Post-Create Callback (<code>HsmFltPostCREATE</code>) and proceed sequentially to the target function. These intermediate functions validate entry conditions based on file/stream attributes and Reparse Point information, so we can bypass them by crafting a special file structure.</p> <ol> <li>Use <code>MakeDataBuffer()</code> to create an <code>IO_REPARSE_TAG_CLOUD</code> structure &#x2192; The minifilter recognizes the file as a cloud stub file and enters the Reparse Point parsing logic.</li> <li>Set Item Tag = <code>0x11</code> (Bitmap) &#x2192; Configure <code>Size</code> to <code>0x1000 + overSize</code> to trigger a heap overflow in <code>memmove()</code> by copying more than the allocated size. Ensure that other elements (Tags <code>0x7</code>, <code>0x6</code>, <code>0xA</code>, etc.) are also set to pass the minifilter&#x2019;s boundary checks.</li> <li>Include a fake kernel object pointer in the overflow data &#x2192; Apply it with <code>FSCTL_SET_REPARSE_POINT</code>, then trigger <code>HsmIBitmapNORMALOpen()</code> by calling <code>CreateFile()</code>.</li> </ol> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image11.png" alt></p> <p>When these conditions are met, we can confirm that the flow starts from <code>FltMgr</code> and reaches <code>HsmIBitmapNORMALOpen()</code>.</p> <p>I&#x2019;d like to cover the full exploit process, but since today&#x2019;s focus is on explaining the minifilter and I&#x2019;ve already gone overboard with the length&#x2026; let&#x2019;s wrap up with a summary of the entire exploit scenario.</p> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image12.png" alt></p> <blockquote> <p>Proof of Concept Overview</p> </blockquote> <ol> <li><p><strong>EPROCESS Structure Analysis and Token Field Offset Calculation</strong></p> <p> Calculate the offset of the Token field within the EPROCESS structure to prepare for the subsequent SYSTEM token swap.</p> </li> <li><p><strong>First <code>WNF_STATE_DATA</code> Spray and Hole Creation</strong></p> <p> Mass-allocate (<code>spray</code>) <code>WNF_STATE_DATA</code> objects of size 0x1000 (0xff0 data) and then free them to create heap holes in the kernel heap.</p> </li> <li><p><strong>Open Vulnerable Bitmap File and Trigger First Overflow</strong></p> <p> Use <code>CfRegisterSyncRoot()</code> and manipulate the Reparse Point directory to prepare a vulnerable bitmap file within the Sync Root. Then, open the file with <code>CreateFile()</code> to reach the path:</p> <p> <code>IRP_MJ_CREATE()</code> &#x2192; <code>HsmFltPostCREATE()</code> &#x2192; <code>HsmiFltPostECPCREATE()</code> &#x2192; <code>HsmpSetupContexts()</code> &#x2192; <code>HsmpCtxCreateStreamContext()</code> &#x2192; <code>HsmIBitmapNORMALOpen()</code></p> <p> Trigger a heap overflow to modify the <code>DataSize</code> of an adjacent <code>WNF_STATE_DATA</code>, gaining OOB (Out-of-Bounds) read/write capability.</p> </li> <li><p><strong>Kernel Pointer Leak</strong></p> <p> Use the modified <code>WNF_STATE_DATA</code> to read the <code>_KALPC_RESERVE</code> pointer and leak a kernel address.</p> </li> <li><p><strong>Second <code>WNF_STATE_DATA</code> Spray and Hole Creation</strong></p> <p> Repeat the same spray-and-free process for <code>WNF_STATE_DATA</code> objects, but this time arrange for a <code>PipeAttribute</code> structure to be placed adjacent to the WNF object.</p> </li> <li><p><strong>Second Overflow to Manipulate <code>PipeAttribute</code></strong></p> <p> Open a second bitmap file to trigger another heap overflow, overwriting the <code>Flink</code> pointer of the adjacent <code>PipeAttribute</code> with the address of a user-space fake <code>PipeAttribute</code> structure.</p> </li> <li><p><strong>Arbitrary Read to Retrieve EPROCESS/Token Addresses</strong></p> <p> Use the fake <code>PipeAttribute</code> to access the ALPC Port structure, sequentially reading the EPROCESS address and Token address of the target process.</p> </li> <li><p><strong>Token Swapping and SYSTEM Privilege Escalation</strong></p> <p> Perform an arbitrary write to replace the current process&#x2019;s Token value with the SYSTEM Token value, then launch <code>cmd.exe</code> with SYSTEM privileges.</p> </li> </ol> <h3 id="ALPC-WNF"><a href="#ALPC-WNF" class="headerlink" title="ALPC / WNF"></a>ALPC / WNF</h3><p>The <code>_WNF_STATE_DATA</code> and <code>_ALPC_HANDLE_TABLE</code> structures are used to allocate arbitrary-sized kernel objects for heap holes and to leak kernel memory addresses. Since ALPC and WNF might be unfamiliar concepts, here is a brief explanation of the two subsystems relevant to this exploit:</p> <blockquote> <p><strong>ALPC (Asynchronous Local Procedure Call)</strong></p> </blockquote> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image13.webp" alt></p> <p>ALPC is an inter-process communication (IPC) mechanism within the Windows kernel that uses client and server ports to exchange messages. By leveraging the <code>_ALPC_HANDLE_ENTRY</code> in the ALPC handle table, it is possible to store message buffer addresses. Since the size of this table is variable, it allows the creation of kernel objects of arbitrary size.</p> <ul> <li>When an ALPC port is created, an <code>_ALPC_HANDLE_TABLE</code> is allocated in the <strong>paged pool</strong> with a size of 0x80.</li> <li>Each call to <code>NtAlpcCreateResourceReserve</code> creates a <code>_KALPC_RESERVE</code> object, and its address is added to the handle table.</li> <li><p>By tampering with this structure, it becomes possible to obtain arbitrary kernel address read/write primitives.</p> <p> &#x2192; In the PoC, a fake <code>_KALPC_RESERVE</code> is injected to achieve arbitrary R/W.</p> </li> <li><p>ALPC handles can also be controlled from user mode, making them highly useful for exploitation.</p> </li> </ul> <blockquote> <p><strong>WNF (Windows Notification Facility)</strong></p> </blockquote> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image14.webp" alt></p> <p>WNF is the Windows Notification Facility, and the <code>WNF_NAME_INSTANCE</code> kernel object contains an internal <code>_WNF_STATE_DATA</code> field whose size is variable. This allows direct control of the kernel object size from user mode using <code>NtCreateWnfStateName</code> + <code>NtUpdateWnfStateData</code>.</p> <ul> <li><code>_WNF_STATE_DATA</code> can be allocated with a size of 0x1000 (0x10 header + 0xFF0 data).</li> <li>WNF objects can be mass-created for heap spraying, placing them adjacent to a target structure (e.g., an ALPC object).</li> <li>In the PoC, WNF is used to create heap holes and then place them next to ALPC objects to trigger an overflow into the ALPC handle table.</li> </ul> <p>In particular, the PoC required registering a routine to create a pipe, which I found interesting.</p> <pre><code class="hljs c"><span class="hljs-class"><span class="hljs-keyword">struct</span> <span class="hljs-title">PipeAttribute</span> {</span> LIST_ENTRY <span class="hljs-built_in">list</span>; <span class="hljs-keyword">char</span> *AttributeName; <span class="hljs-keyword">uint64_t</span> AttributeValueSize; <span class="hljs-keyword">char</span> *AttributeValue; <span class="hljs-keyword">char</span> data[<span class="hljs-number">0</span>]; };</code></pre> <p>The pipe is configured so that the <code>AttributeValue</code> pointer in the modified <code>PipeAttribute</code> structure is set to a kernel memory address. This causes the kernel to read data from that address and return it to user mode. By combining the memory layout control achieved via ALPC with the WNF overflow, the pipe can be turned into an arbitrary read primitive, allowing leakage of kernel addresses.</p> <h1 id="3-Conclusion"><a href="#3-Conclusion" class="headerlink" title="3. Conclusion"></a>3. Conclusion</h1><hr> <p><img src="/2025/08/15/banda/Minifilter-Driver/en/image15.gif" alt></p> <p>I&#x2019;ll wrap up by sharing the results of the LPE I implemented using the characteristics of the <code>cldflt.sys</code> Minifilter driver combined with the WNF + ALPC technique.</p> <p>While studying Minifilters, I realized that although their operation, functions, and concepts may feel a bit unfamiliar, the way vulnerabilities are triggered and their root causes are, in the end, quite similar. So, there&#x2019;s no need to be too intimidated about diving into Minifilter exploitation!</p> <p>If I get the chance, I&#x2019;d like to explore and study various other drivers I haven&#x2019;t looked into yet. I hope you&#x2019;ll look forward to my next write-up as well!</p> <h1 id="Reference"><a href="#Reference" class="headerlink" title="Reference"></a><strong>Reference</strong></h1><hr> <p><a href="https://exploitreversing.com/2023/04/11/exploiting-reversing-er-series/">https://exploitreversing.com/2023/04/11/exploiting-reversing-er-series/</a></p> <p><a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts">https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts</a></p> <p><a href="https://starlabs.sg/blog/2024/all-i-want-for-christmas-is-a-cve-2024-30085-exploit/">https://starlabs.sg/blog/2024/all-i-want-for-christmas-is-a-cve-2024-30085-exploit/</a></p> <p><a href="https://ssd-disclosure.com/ssd-advisory-cldflt-heap-based-overflow-pe/">https://ssd-disclosure.com/ssd-advisory-cldflt-heap-based-overflow-pe/</a></p> <p><a href="https://reddogsecurity.substack.com/p/elevating-privileges-in-windows-insights?r=5awqb0&amp;utm_campaign=post&amp;utm_medium=web&amp;triedRedirect=true">https://reddogsecurity.substack.com/p/elevating-privileges-in-windows-insights?r=5awqb0&amp;utm_campaign=post&amp;utm_medium=web&amp;triedRedirect=true</a></p> <p><a href="https://medium.com/@WaterBucket/understanding-mini-filter-drivers-for-windows-vulnerability-research-exploit-development-391153c945d6">https://medium.com/@WaterBucket/understanding-mini-filter-drivers-for-windows-vulnerability-research-exploit-development-391153c945d6</a></p> - hack & life

Discover how adversaries are using tools like EDRSilencer to tamper with EDR communications and learn how you can fight back.

No Agent, No Problem: Discovering Remote EDR As the reader, I’m sure you’re thinking — “oh great, another EDR internals or bypass post”. I can fully understand that sentiment, as EDRs are …

Uncovering Windows Events Threat Intelligence ETW Not all manifest-based Event Tracing for Windows (ETW) providers that are exposed through Windows are ingested into telemetry sensors/EDR’s. One …

Understanding ETW Patching Introduction As of late, I have gotten a lot of questions around Event Tracing for Windows (ETW) patching, specifically the following questions: Which ETW providers can be …

Understanding Telemetry: Kernel Callbacks Introduction I’ve published blogs around telemetry mechanisms like Event Tracing for Windows (ETW) in the Uncovering Windows Events series, but one …

Multiple out-of-bounds read and null dereference bugs were identified in Microsoft Defender by using Snapshot Fuzzing with WTF and kAFL/NYX. The bugs can be used to crash the main Defender process as soon as the file is scanned. Most are unpatched, but none appear exploitable for code execution.

This article gives an overview of the attack surface of EDR software and describes the process to search for attack surface on EDR drivers from a low-privileged user.

The second part describes the process and results of the EDR driver security analysis of Palo Alto Cortex using manual analysis and Sophos Intercept X using snapshot fuzzing. Only minor vulnerabilities were identified (CVE-2024-5905).

Call stacks are an understated yet often important source of telemetry for EDR products.

Event Tracing for Windows (ETW) is an efficient kernel-level tracing facility that lets you log kernel or application-defined events to a log file.

Sysmon vs Microsoft Defender for Endpoint, MDE Internals 0x01 It is not a big secret that we at FalconForce work a lot with, and are big fans of, both Microsoft Defender for Endpoint (MDE) and …

Enumerating Windows Process Creation Callbacks Welcome to this new post. Today we’re going to look at how Windows tracks which drivers get notified every time a new process is created, and how we …

Removing Process Creation Kernel Callbacks Introduction Kernel callbacks is a popular mechanism for AV/EDR products which provides those products with a way to monitor process activity on the system …

“” is published by Excalibra in MeetCyber.

By John Uhlmann on 2026-02-17

By Connor McGarr on 2026-01-19

Your new best friend: Introducing BloodHound Community Edition!

Learn to bypass EDR detection using NtContinue for hardware breakpoints without triggering ETW Threat Intelligence. This technical blog explores kernel debugging, debug registers, and EDR evasion with code examples., Learn to bypass EDR detection using NtContinue for hardware breakpoints without triggering ETW Threat Intelligence. This technical blog explores kernel debugging, debug registers, and EDR evasion with code examples.

A key development in endpoint security optics, Microsoft’s Antimalware Scan Interface (AMSI) helps defenders zero in on in-memory payloads.

Latest Research by our Team

Since security solution vendors began moving away from user-mode hooks to kernel-mode for API interception and logging, Microsoft Threat Intelligence Event Tracing for Windows (or ETW-TI) has been used to detect a variety of adversarial tactics. Sin...

An RE deep dive at why Microsoft Defender can create an svchost.exe process without the usual service-host command-line flags.

Implementing API Hooking Inside My EDR From injection timing and loader locks to intercepting LdrLoadDll In this post, I will be sharing my journey thru implementing API hooking inside my custom EDR …

Detecting Active Directory Enumeration

Learn how SafeBreach developed malware integrated within Palo Alto Networks Cortex XDR, exploiting its ransomware protection feature.

In the wake of a gathering of industry leaders at Microsoft to discuss the endpoint-security ecosystem, some thoughts

This post will focus on the process I followed to understand the events the Threat-Intelligence ETW provider logs and how to uncover the underlying mechanisms.

See the precise cause of security-related events with enhanced Windows logs.

A quick look into ETW capabilities against malicious API calls.

By now direct system calls are ubiquitous in offensive tooling. Manual system calls remain effective for evading userland based EDRs. From within userland…