Further ETW-TI Events (Question/Enhancement)

[Muffinman99991]

Hi Dobin

Is it correct that currently only the following two ETW-TI events have been implemented?

• ALLOCVM_LOCAL
• PROTECTVM_LOCAL

Is there already a plan to implement further events from the ETW-TI?

[dobin]

Good question. The code doesnt restrict which events from ETW-TI RedEdr consumes. It should be all of the types, no filtering.
https://github.com/dobin/RedEdr/blob/master/RedEdrPplService/etwtireader.cpp#L27

But the current deployed version seems to only "get" a subset. I will have a look.

[dobin]

Here it is described how it is possible enable it by setting per-process with the kernel callbacks:
https://fluxsec.red/reverse-engineering-windows-11-kernel

I do some more research, and/or implement it.

[dobin]

More details: https://www.originhq.com/blog/process-preluding

Still tbd

[dobin]

some references, not very useful:
https://learn.microsoft.com/en-us/previous-versions/mt826264(v=vs.85)
https://github.com/winsiderss/systeminformer/blob/6d779c43258b3c229835dc317a84d0507eeff7b3/phnt/include/ntpsapi.h#L1473-L1492
https://blog.deeb.ch/posts/windows-telemetry/
https://docs.rs/ntapi/latest/src/ntapi/ntpsapi.rs.html#728-734
https://github.com/m417z/ntdoc/blob/main/descriptions/processinfoclass.md

relevant blog article:
https://fluxsec.red/event-tracing-for-windows-threat-intelligence-rust-consumer

existing implementation:
https://github.com/0xflux/Sanctum/blob/main/driver/src/core/process_callbacks.rs
https://github.com/0xflux/Sanctum/blob/main/sanctum_ppl_runner/src/tracing.rs

more blog articles:
https://jonny-johnson.medium.com/behind-the-mask-unpacking-impersonation-events-fca909e08d00
https://www.legacyy.xyz/defenseevasion/windows/2024/04/24/disabling-etw-ti-without-ppl.html

[dobin]

Ok i am confused as fuck. Need to write it down.

Old

NOT using EnableProcessTelemetryLogging(), as before:

• testexe: SUSPENDRESUME_THREAD, WRITEVM
• procexp64: nothing
• putty: nothing
• edge: ALLOCVM, PROTECTVM, SUSPENDRESUME_THREAD, WRITEVM

procexp64 and putty dont emit any ETW-TI (signed? known good?). My testexe has the SUSPENDRESUME_THREAD, but no READVM.
Edge emits events, even tho it should be known-good.

New

Using the new EnableProcessTelemetryLogging() results in the following ETW-TI event types:

• testexe: READVM, WRITEVM
• procexp64: READVM, WRITEVM
• putty: READVM, WRITEVM
• edge: ALLOC, PROTECTVM, SUSPENDRESUME_THREAD, WRITEVM

All observed processes emit ETW-TI events. But no READVM. testexe misses SUSPENDRESUME_THREAD, but Edge has it.

Assumption

Using EnableProcessTelemetryLogging() will restrict to a subset of ETW-TI types, but enables it every process.

Other notes

The QueueUserAPC() in testexe doesnt trigger the KERNEL_THREATINT_TASK_QUEUEUSERAPC in both cases (maybe because its in the same process?)

OP mentioned that only ALLOC and PROTECT were visible, which was also my impression from previous testing.

[dobin]

So to enable logging, there are two ways. This is mostly based on https://www.legacyy.xyz/defenseevasion/windows/2024/04/24/disabling-etw-ti-without-ppl.html

PROCESS_READWRITEVM_LOGGING_INFORMATION

The simple and old one, only ReadVm and WriteVm (?).

ProcessEnableReadWriteVmLogging = 0x57

typedef struct _PROCESS_READWRITEVM_LOGGING_INFORMATION
{
    UCHAR Flags;
    UCHAR EnableReadVmLogging;
    UCHAR EnableWriteVmLogging;
    UCHAR Unused = 6;
} PROCESS_READWRITEVM_LOGGING_INFORMATION, *PPROCESS_READWRITEVM_LOGGING_INFORMATION;

PROCESS_LOGGING_INFORMATION

The new good one.

ProcessEnableLogging = 0x60

typedef struct _PROCESS_LOGGING_INFORMATION
{
    ULONG Flags;
    ULONG EnableReadVmLogging;
    ULONG EnableWriteVmLogging;
    ULONG EnableProcessSuspendResumeLogging;
    ULONG EnableThreadSuspendResumeLogging;
    //ULONG EnableLocalExecProtectVmLogging;  // New in Win11
    //ULONG EnableRemoteExecProtectVmLogging; // New in Win11
    ULONG Reserved = 26;
}

Set it like:

    PROCESS_LOGGING_INFORMATION processLoggingInfo = { 0 };
    processLoggingInfo.Bits.EnableReadVmLogging = 1;
    processLoggingInfo.Bits.EnableWriteVmLogging = 1;
    processLoggingInfo.Bits.EnableProcessSuspendResumeLogging = 1;
    processLoggingInfo.Bits.EnableThreadSuspendResumeLogging = 1;

    // Win11 (error on win10!)
    processLoggingInfo.Bits.EnableLocalExecProtectVmLogging = 1;
    processLoggingInfo.Bits.EnableRemoteExecProtectVmLogging = 1;
    processLoggingInfo.Bits.EnableImpersonationLogging = 1;

    NTSTATUS Status = NtSetInformationProcess(
        (HANDLE)-1,
        (ULONG)ProcessEnableLogging,
        &ProcessLoggingInformation,
        sizeof(_PROCESS_LOGGING_INFORMATION));

Setting any of the Win11 flags on a Win10 machine will produce a ZwSetInformationProcess failed: 0xC000000D.

With correct usage:

[RedEdr KRN] [RedEdr] pid 1652 ETW-TI flags=0x0E: ReadVM=0 WriteVM=1 ProcSuspRes=1 ThrSuspRes=1 LocalExecProt=0 RemoteExecProt=0 Impersonation=0 reserved=0x00
[RedEdr KRN] Enabled ETW-TI logging for pid 1652: 1
[RedEdr KRN] [RedEdr] pid 1652 ETW-TI flags=0x0F: ReadVM=1 WriteVM=1 ProcSuspRes=1 ThrSuspRes=1 LocalExecProt=0 RemoteExecProt=0 Impersonation=0 reserved=0x00

Note that we set "ReadVM" to true.