DOCSEARCHbyAlgolia
Submit Docs

Telemetry Sourcerer Documentation

repository·master·Indexed 21 days ago

https://github.com/jthuraisamy/telemetrysourcerer

A research tool for Windows (7 and 10 x64) designed to enumerate and disable common telemetry sources used by AV/EDR products. Key features include kernel-mode callback enumeration and suppression, user-mode inline hook detection and removal, and ETW session and provider enumeration.

Tokens
700
Snippets
4
Records
6
Agent score
25%

What's inside Telemetry Sourcerer

  1. Telemetry Sourcerer Features

    master

    Telemetry Sourcerer provides the following capabilities for security research:

    • Kernel-mode Callback Enumeration: Identifies and provides the ability to suppress various kernel-mode callbacks.
    • User-mode Hook Detection: Detects inline user-mode hooks within the current process and provides the ability to unhook them.
    • ETW Enumeration: Lists ETW (Event Tracing for Windows) sessions and providers, highlighting relevant ones that can be disabled.

  2. Enable Test Signing Mode for Kernel-mode Callbacks

    master

    Because the driver provided with Telemetry Sourcerer is not signed, you must enable Windows Test Signing mode to load it. This requires disabling BitLocker and Secure Boot first.

    1. Disable BitLocker and Secure Boot.
    2. Open an elevated Command Prompt.
    3. Run bcdedit.exe -set TESTSIGNING ON.
    4. Reboot the system.
    5. Launch Telemetry Sourcerer with elevated privileges.
    bcdedit.exe -set TESTSIGNING ON

  3. Disable Driver Signature Enforcement (DSE) using KDU

    master

    You can use the KDU tool to temporarily disable Driver Signature Enforcement (DSE) to load the unsigned driver. Note that this method may be incompatible with Kernel Patch Protection (KPP) on Windows 8.1 and later.

    1. Clone KDU: git clone https://github.com/hfiref0x/KDU.git.
    2. Open an elevated Command Prompt.
    3. Disable DSE: kdu -dse 0.
    4. Launch Telemetry Sourcerer with elevated privileges.
    5. Re-enable DSE: kdu -dse 6.
    kdu -dse 0
# ... run Telemetry Sourcerer ...
kdu -dse 6

  4. Run Telemetry Sourcerer

    master

    To use Telemetry Sourcerer, download the latest release, extract the files, and launch the executable. For full functionality, including the enumeration of kernel-mode callbacks and accessing more ETW sessions, you must run the executable with elevated privileges.

    1. Download the latest release.
2. Extract files.
3. Launch the executable (run elevated).

  5. Sign the TelemetrySourcererDriver with SignTool

    master

    If you have a valid cross-certificate from Microsoft, you can sign the driver manually using signtool from the Windows SDK.

    Use the following command structure: signtool sign /a /ac "cross-cert.cer" /f "cert.pfx" /p "password" TelemetrySourcererDriver.sys

    signtool sign /a /ac "cross-cert.cer" /f "cert.pfx" /p "password" TelemetrySourcererDriver.sys

  6. Telemetry Sourcerer Limitations and Compatibility

    master

    When using Telemetry Sourcerer, be aware of the following constraints:

    • Supported OS: Tested on Windows 7 and 10 (x64) only.
    • Missing Capabilities: Does not currently detect IAT/EAT user-mode hooks or kernel-mode hooks.
    • Build Environment: Compiled with Visual Studio 2019, Windows 10 SDK (10.0.19041.0), and WDK (2004).
    • Safety Warning: The tool is intended for research purposes and is not OPSEC-safe for production environments. The driver has not been thoroughly tested for abuse cases.