DOCSEARCHbyAlgolia
Submit Docs

Best Edr Of The Market (BEOTM) Documentation

repository·main·Indexed 23 days ago

https://github.com/xacone/bestedrofthemarket

An open-source educational lab for studying low-level Windows kernel detection techniques used by EDR products. BEOTM V3 implements detection methods and workarounds using Windows NT telemetry, including system call interception, VAD tree exploitation, kernel callbacks, and Shadow Stack verification. It detects TTPs such as PPID Spoofing, Credential Dumping, and Process Hollowing. The project consists of a user-mode application (beotm.exe) and a kernel driver (beotm.sys/BeotmDrv) communicating via IOCTL codes.

Tokens
1.7K
Snippets
2
Records
11
Agent score
31%

What's inside Best Edr Of The Market (BEOTM)

  1. Overview of Best Edr Of The Market (BEOTM) V3

    main

    Best Edr Of The Market (BEOTM) V3 is an open-source security lab designed for the low-level implementation and understanding of Endpoint Detection & Response (EDR) detection methods and their workarounds. It leverages Windows NT telemetry to analyze process behavior and detect various TTPs (Tactics, Techniques, and Procedures).

    Key Defensive Capabilities:

    • System Calls Interception via Alternative System Call Handlers
    • Virtual Address Descriptor (VAD) Tree exploitation for Image Integrity Checking
    • Kernel callbacks for thread/process creation, image loading, registry, and object operations
    • Code injection detection via thread call stack validation
    • Yara rule integration for pattern detection in memory/files
    • System call integrity checking
    • Shadow Stack leverage for thread call stack integrity verification

    Detected TTPs include:

    • PPID Spoofing (T1134.004)
    • Credential Dumping (T1003.001)
    • Process Hollowing/Ghosting/Tampering (T1055.012)
    • Memory code injection (T1055), including APC queuing (T1055.004) and Thread Hijacking (T1055.003)
    • Abnormal System Calls (T1106)
    • Registry Persistence Operations (T1547.001)

  2. Manage the BeotmDrv Service

    main

    When beotm.exe is terminated, the kernel driver service remains active on the system. The service is named BeotmDrv. If you run beotm.exe again, you do not need to re-install the driver.

    To check if the service is running:

    sc.exe query type=driver | findstr /i "beotm"

    To stop the service:

    sc.exe stop BeotmDrv

  3. Run BEOTM v3

    main

    To run the BEOTM user-mode application, use beotm.exe with the path to the driver file and the path to the folder containing Yara rules. The application must be run in Administrator mode.

    beotm.exe handles the installation of the beotm.sys driver automatically. Once the driver is installed, it compiles the provided Yara rules. After compilation, you can access the UI panel by pressing any key.

  4. Build the BEOTM Project

    main

    The project is developed in Visual Studio 2022 using C++20.

    Prerequisites:

    • Windows Driver Kit (WDK).
    • x64 spectrum mitigation libraries.
    • yara installed via vcpkg.

    Linker Configuration: If you encounter "Symbol not found" errors (related to unimplemented NDIS TCP/IP filtering), you must manually add the following libraries to: BestEdrOfTheMarketDriver -> Project Properties -> Linker -> Entry -> Additional Dependencies:

    $(DDK_LIB_PATH)\fwpkclnt.lib
$(DDK_LIB_PATH)\ndis.lib
$(SDK_LIB_PATH)\uuid.lib

    Installing Yara via vcpkg:

    # Bootstrap vcpkg if not present
git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat

# Install yara
.\vcpkg\vcpkg.exe install yara

  5. Setup Requirements for BEOTM

    main

    BEOTM is designed for a controlled testing environment (e.g., a Windows Virtual Machine).

    Critical Requirements:

    • The Windows machine must be configured in TESTSIGNING mode to allow the driver to load.
    • Recommended OS: Windows 10 22H2.
    • For kernel debugging, you can use WinDbg to monitor the remote VM kernel. Upon launch, BEOTM will output a status log in the debugger indicating if kernel callbacks (e.g., PsSetCreateProcessNotifyRoutineEx, ObRegisterCallbacks) were successfully registered.

  6. Install and Run the BEOTM Driver

    main

    The BEOTM application requires a driver file and a directory containing YARA rules to function. The application handles the installation of the driver into the Windows Service Control Manager (SCM) and starts it automatically.

    Usage: Run the executable from the command line with the following arguments: [executable] <path to driver> <path to YARA rules directory>

    Note: The application uses BeotmDrv as the default driver name. If the process is interrupted (e.g., via Ctrl+C), the application attempts to uninstall and stop the driver automatically.

  7. Install the BEOTM Driver via InstallBeotmDriver()

    main

    The InstallBeotmDriver function registers the driver with the Windows Service Control Manager (SCM) and starts the service. It handles cases where the service already exists by attempting to open the existing service instead of creating a new one.

    Parameters:

    • drvName (const std::wstring&): The name of the driver service.
    • drvPath (const std::wstring&): The full path to the driver file.

    Returns:

    • bool: true if the driver was successfully installed and started, false otherwise.

  9. Consume IOCTL Data from the BEOTM Driver

    main

    The application communicates with the kernel driver using DeviceIoControl via the ConsumeIOCTLData function. This function runs in background threads to monitor security events.

    Supported IOCTL Codes:

    • BEOTM_RETRIEVE_DATA_BYTE: Retrieves byte stream data for memory-based analysis.
    • BEOTM_RETRIEVE_DATA_FILE: Retrieves file-based notifications for filesystem analysis.
    • BEOTM_RETRIEVE_DATA_BUFFER: Retrieves general data buffers.

    Parameters:

    • deviceName (LPCWSTR): The device path (e.g., \\.\Beotm).
    • ioctlCode (DWORD): The specific IOCTL code to use.
    • sleepDurationMs (int): The interval in milliseconds between polling attempts.

  11. Reference: BEOTM IOCTL Control Codes

    main

    The following control codes are used for communication between the user-mode application and the kernel driver via DeviceIoControl:

    CodePurpose
    BEOTM_RETRIEVE_DATA_BUFFERRetrieve general data buffers
    BEOTM_RETRIEVE_DATA_FILERetrieve file-based security notifications
    BEOTM_RETRIEVE_DATA_BYTERetrieve byte stream data for memory analysis
    END_THAT_PROCESSCommand the driver to terminate a specific PID
    #define BEOTM_RETRIEVE_DATA_BUFFER CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define BEOTM_RETRIEVE_DATA_FILE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define BEOTM_RETRIEVE_DATA_BYTE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define END_THAT_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x216, METHOD_BUFFERED, FILE_ANY_ACCESS)