DOCSEARCHbyAlgolia
Submit Docs

CrimsonEDR Documentation

repository·main·Indexed 20 days ago

https://github.com/helixo32/crimsonedr

An open-source tool for developers and security researchers to detect and study EDR circumvention techniques. It identifies malware evasion methods including AMSI and ETW patching, NTDLL unhooking, direct syscalls, PE stomping, and reflective PE loading. The system consists of a detection DLL injected into target processes via CrimsonEDRPanel.exe and supports custom pattern searching through an ioc.json configuration file.

Tokens
2.2K
Snippets
7
Records
11
Agent score
69%

What's inside CrimsonEDR

  1. CrimsonEDR Detection Features

    main

    CrimsonEDR identifies various malware patterns and evasion techniques, including:

    • Direct Syscall: Detects direct system calls used to bypass API hooks.
    • NTDLL Unhooking: Identifies attempts to unhook functions in the NTDLL library.
    • AMSI Patch: Detects byte-level modifications to the Anti-Malware Scan Interface.
    • ETW Patch: Detects byte-level alterations to Event Tracing for Windows.
    • PE Stomping: Identifies PE (Portable Executable) stomping.
    • Reflective PE Loading: Detects reflective loading of PE files.
    • Unbacked Thread Origin: Identifies threads originating from unbacked memory.
    • Unbacked Thread Start Address: Detects threads with start addresses in unbacked memory.
    • API hooking: Monitors NtWriteVirtualMemory to detect memory modifications.
    • Custom Pattern Search: Searches for user-defined patterns provided in ioc.json.

  2. Install CrimsonEDR

    main

    To install and compile CrimsonEDR, you need the gcc-mingw-w64-x86-64 dependency. Follow these steps to clone the repository and run the provided compilation script.

    # 1. Install dependency
sudo apt-get install gcc-mingw-w64-x86-64

# 2. Clone the repository
git clone https://github.com/Helixo32/CrimsonEDR

# 3. Compile the project
cd CrimsonEDR
chmod +x compile.sh
./compile.sh

  3. How the CrimsonEDR detection loop works

    main

    Once LaunchEDR() is called, the engine performs the following lifecycle:

    1. Initialization: It gathers process metadata (filename, path, PID) and populates an INFORMATION_DETECTION structure.
    2. Hooking: It attempts to place a hook on NtWriteVirtualMemory using PlaceHook().
    3. Monitoring Loop: It enters an infinite while (TRUE) loop that sleeps for 10 seconds between iterations. In each iteration, it runs a series of detection checks.
    4. Detection & Response: If any detection function returns true (indicating a threat), the engine:
      • Sends the detection metadata to a pipe via SendToPipe().
      • Terminates the current process using TerminateProcess() to prevent further malicious activity.

    Supported Detection Checks:

    • CheckPatchByteAMSI: Detects AMSI patching.
    • CheckPatchByteETW: Detects ETW patching.
    • NtdllUnhooking: Detects ntdll unhooking attempts.
    • UnhookedAPI: Detects unhooked APIs.
    • PeStomping: Detects PE Stomping.
    • DirectSyscall: Detects direct syscall usage.
    • UnbackedThreadStartAddress: Detects threads starting from unbacked memory.
    • UnbackedThreadOrigin: Detects threads originating from unbacked memory.
    • ReflectivePE: Detects Reflective PE loading.
    • SearchIOC: Performs Indicator of Compromise (IOC) searches on specific memory regions.
    // Conceptual flow within LaunchEDR()
while (TRUE) {
    if (CheckPatchByteAMSI(&informationDetection)) {
        SendToPipe(&informationDetection);
        TerminateProcess(GetCurrentProcess(), 0);
    }
    // ... other checks
    Sleep(10 * 1000);
}

  4. Configure Custom Pattern Search via ioc.json

    main

    CrimsonEDR supports custom pattern searching using an ioc.json file.

    Important: The ioc.json file must be placed in the current directory from which the monitored executable is launched. For example, if the target process is running from C:\Users\admin\, the DLL will look for C:\Users\admin\ioc.json.

    The JSON file should contain an IOC key mapping to an array of byte arrays (represented as hex strings).

    {
  "IOC": [
    ["0x03", "0x4c", "0x24", "0x08", "0x45", "0x39", "0xd1", "0x75"],
    ["0xf1", "0x4c", "0x03", "0x4c", "0x24", "0x08", "0x45", "0x39"]
  ]
}

  5. Troubleshooting: Antivirus False Positives

    main
    Windows Defender and other antivirus programs may flag the CrimsonEDR.dll as malicious. This is because the DLL contains specific bytes used to verify if AMSI has been patched. To avoid interruptions, you must whitelist the DLL or temporarily disable your antivirus.

  6. CrimsonEDRPanel.exe CLI Arguments

    main

    The CrimsonEDRPanel.exe executable accepts the following command-line arguments:

    • -d <path_to_dll>: Specifies the path to the CrimsonEDR.dll file.
    • -p <process_id>: Specifies the Process ID (PID) of the target process where you want to inject the DLL.

  7. Run CrimsonEDRPanel.exe

    main

    Use CrimsonEDRPanel.exe to inject the CrimsonEDR.dll into a target process. You must provide the path to the DLL and the Process ID (PID) of the target process.

    .\CrimsonEDRPanel.exe -d C:\Temp\CrimsonEDR.dll -p 1234

  8. Initialize CrimsonEDR via DllMain

    main

    CrimsonEDR is designed to be loaded as a DLL into a target process. When the DLL is attached to the process (DLL_PROCESS_ATTACH), it automatically triggers the LaunchEDR() function. This function initiates the detection engine, places necessary hooks, and enters a monitoring loop to check for various evasion and exploitation techniques.

    BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
        case DLL_PROCESS_ATTACH:
            // Triggers the EDR detection engine
            LaunchEDR();
            break;
        // ... other cases
    }
    return TRUE;
}

  9. Reference: CrimsonEDR Detection Functions

    main

    The following functions are used within the LaunchEDR loop to identify malicious activity. Most functions accept a pointer to an INFORMATION_DETECTION structure and return a boolean indicating if a threat was found.

    // Detection functions used in the monitoring loop:
CheckPatchByteAMSI(INFORMATION_DETECTION *info)
CheckPatchByteETW(INFORMATION_DETECTION *info)
NtdllUnhooking(INFORMATION_DETECTION *info)
UnhookedAPI(INFORMATION_DETECTION *info)
PeStomping(INFORMATION_DETECTION *info)
DirectSyscall(INFORMATION_DETECTION *info)
UnbackedThreadStartAddress(INFORMATION_DETECTION *info, PVOID *pAddress, SIZE_T *regionSize)
UnbackedThreadOrigin(INFORMATION_DETECTION *info, PVOID *pAddress, SIZE_T *regionSize)
ReflectivePE(INFORMATION_DETECTION *info, PVOID *pAddress, SIZE_T *regionSize)
SearchIOC(INFORMATION_DETECTION *info, PVOID pAddress, SIZE_T regionSize)

  11. Use the CrimsonEDR CLI to monitor a process

    main

    The CrimsonEDR management panel is a command-line tool used to monitor a specific process by injecting a DLL and listening for detection events via a named pipe (\\.\pipe\CrimsonEDRPipe).

    To use the tool, you must provide the Process ID (PID) of the target process and the file path to the DLL intended for injection.

    Command-line Arguments

    • -p <PID>: Specifies the Process ID of the process you wish to monitor.
    • -d <path>: Specifies the absolute path to the DLL file to be injected into the target process.

    If the monitored process is marked as Killed in a received event, the tool will prompt you to enter a new PID to continue monitoring.

    # Example: Monitor PID 1234 using a specific DLL
./crimsonedr -p 1234 -d C:\path\to\your\library.dll