Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons is a callstack scanner designed to identify Indicators of Compromise (IOCs) that suggest the presence of an unpacked or injected Command and Control (C2) agent.

The tool operates on the principle that C2 agents frequently idle between callbacks. It analyzes what causes a thread to idle by scanning callstacks for various techniques used to hide beacon activity, such as sleepmasks, module stomping, and return address spoofing.

Key Limitations:

• Most detected IOCs are not 100% true positives (e.g., module stomping detection is prone to false positives).
• By default, DotNet and 32-bit binaries are ignored.

The tool detects sleepmask implementations that utilize Windows asynchronous mechanisms:

• Suspicious APC: If Ntdll!KiUserApcDispatcher is found on the callstack leading to a blocking function (often involving a series of APCs queued to Ntdll!NtContinue to trigger Ntdll!WaitForSingleObject), it is flagged as an IOC.
• Suspicious Timers: If ntdll!RtlpTpTimerCallback is found on the callstack leading to a blocking function, it is flagged as an IOC.
• Timer Enumeration: The tool also enumerates timers and their exact callbacks from userland using NtQueryInformationWorkerFactory with WorkerFactoryBasicInformation. It traverses the TimerQueue linked list to find callbacks pointing to suspicious API calls like ntdll!ntcontinue.

The tool identifies advanced evasion techniques:

• Abnormal Intermodular Calls (Module Proxying): Detects sequences where the NTAPI is used to call the WINAPI (e.g., a callstack pattern of ntdll.dll -> kernel32.dll -> ntdll.dll ending in a blocking function). This is an indicator of attempts to bypass stack tracing.
• Return Address Spoofing: The tool iterates through every return address in callstacks to search for patterns indicating a return to a jmp [Nonvolatile-Register] gadget, a common technique used in return address spoofing.

Beacons sometimes avoid private memory by loading and overwriting a legitimate module from disk (Module Stomping).

This tool identifies manipulated images by checking the VirtualAttributes.SharedOriginal field of MEMORY_WORKING_SET_EX_INFORMATION. If a page in the callstack is not private but SharedOriginal == 0, it is flagged as an IOC.

Warning: This detection method is highly prone to false positives.

The tool identifies two specific memory-based IOCs:

1. Unbacked Memory: Detects private r(w)x pages in a callstack, which may indicate a beacon that was unpacked or injected at runtime.
2. Non-Executable Memory: Detects suspicious non-executable pages in the callstack. This is a common sign of sleepmasks that change the beacon's page permissions to non-executable while idling.

Run the Hunt-Sleeping-Beacons scanner via the command line by specifying a target Process ID (PID).

Options:

• -p, --pid {PID}: Specify the PID of the process to scan.
• --dotnet: Include DotNet processes in the scan (Note: this is prone to false positives).
• --commandline: Enable the output of the command line for suspicious processes.
• -h, --help: Display the help message.

# Example: Scan a specific PID
hunt-sleeping-beacons -p 1234

# Example: Scan a PID and include command line output
hunt-sleeping-beacons --pid 1234 --commandline

Hunt-Sleeping-Beacons is a command-line tool used to scan processes for suspicious memory patterns and behaviors (sleeping beacons). To run the tool, ensure you are running in an elevated (Administrator) context, as the tool requires debug privileges to inspect process memory.

Execution Flow

1. The tool checks for elevation and attempts to enable SeDebugPrivilege.
2. It enumerates processes based on the provided PID or system-wide.
3. It scans the processes for various detection vectors (e.g., Unbacked Memory, Module Stomping, Suspicious APCs).
4. It outputs suspicious processes and summary statistics to the console.

# Example: Scan a specific process by PID
hsb.exe --pid 1234

# Example: Scan all processes and include command line details
hsb.exe --commandline

# Example: Scan all processes including .NET processes
hsb.exe --dotnet

The CLI tool accepts the following arguments to control the scanning behavior:

-p, --pid <pid>
--dotnet
--commandline
-h, --help