{"uuid": "4748b214-38ce-4dff-8a62-3b5461d5d874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/50136", "content": "Detection  From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques.  Driver whitelisting  Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11).  Kernel-memory integrity checks  Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel.  As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs.  The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation.  User-mode detection  The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll.  In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process.  Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall).  Acknowledgements      Kernel callbacks enumeration and removal:  https://github.com/br-sn/CheekyBlinder      Kernel memory Read / Write primitives through the vulnerable  Micro-Star MSI Afterburner driver:  https://github.com/Barakat/CVE-2019-16098/      Disabling of the ETW Threat Intelligence provider:  https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider      Driver install / uninstall: https://github.com/gentilkiwi/mimikatz      Initial list of EDR drivers names:  https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1      Credential Guard bypass by re-enabling Wdigest through LSASS memory  patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/      Authors  Thomas DIOT (Qazeer) (https://github.com/Qazeer/)  Maxime MEIGNAN (themaks) (https://github.com/themaks)  Licence  CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:12.922179Z"}