FalconEye - Real-time detection

FalconEye is a software designed for endpoint detection on Windows operating systems that specializes in detecting real-time process injections. This is accomplished through the use of a kernel-mode driver that is capable of identifying process injections as they occur. By operating in kernel mode, FalconEye offers a robust and dependable defense against process injection techniques that attempt to bypass user-mode hooks.

Architecture Overview

1. The driver is an on-demand load driver

2. The initialization includes setting up callbacks and syscall hooks via libinfinityhook

3. The callbacks maintain a map of Pids built from cross process activity such as OpenProcess but it is not limited to OpenProcess

4. Subsequent callbacks and syscall hooks use this Pid map to reduce the noise in processing. As a part of noise reduction, syscall hooks filter out same process activity.

5. The detection logic is divided into subcategories namely - stateless (example: Atombombing), stateful (Unmap+Overwrite) and Floating code(Shellcode from multiple techniques)

6. For stateful detections, syscall hooks record an ActionHistory which is implemented as a circular buffer. e.g. It records all the NtWriteVirtualMemory calls where the caller process is different from the target process.

7. The detection logic has common anomaly detection functionality such as floating code detection and detection for shellcode triggers in remote processes. Both callbacks and syscall hooks invoke this common functionality for actual detection.

NOTE: We have been concentrating on detection rather than developing an efficient detection engine. Our endeavors in this area will persist beyond the BlackHat presentation.

Files

  
.
├── src
│   ├── FalconEye ---------------------------# FalconEye user and kernel space
│   └── libinfinityhook ---------------------# Kernel hook implementation
├── 2021BHASIA_FalconEye.pdf
└── README.md