Best EDR Of The Market V3

https://github.com/xacone/bestedrofthemarket
Admin
Best EDR Of The Market V3 is an open-source Windows kernel-level security lab that implements and...
Tokens:7,601
Snippets:54
Trust Score:7.9
License:MIT
Update:6 months ago
Show doc for...
Tokens:
Raw
### Install and Start Kernel Driver

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

Uses the Windows Service Control Manager to register and initiate the kernel-mode driver. Requires administrative privileges to interact with the Service Control Manager.

```cpp
// Install and start the BEOTM kernel driver
#include <Windows.h>
#include <iostream>

SC_HANDLE hService;
SC_HANDLE hSCManager;

bool InstallBeotmDriver(
    const std::wstring& drvName,
    const std::wstring& drvPath
) {
    hSCManager = OpenSCManagerW(NULL, NULL, SC_MANAGER_ALL_ACCESS);

    if (!hSCManager) {
        std::wcerr << L"Failed to open service control manager." << std::endl;
        return false;
    }

    hService = CreateServiceW(
        hSCManager,
        drvName.c_str(),          // Service name: "BeotmDrv"
        drvName.c_str(),          // Display name
        SERVICE_ALL_ACCESS,
        SERVICE_KERNEL_DRIVER,
        SERVICE_DEMAND_START,
        SERVICE_ERROR_NORMAL,
        drvPath.c_str(),          // Path to beotm.sys
        NULL, NULL, NULL, NULL, NULL
    );

    if (!hService) {
        if (GetLastError() == ERROR_SERVICE_EXISTS) {
            // Service exists, open it
            hService = OpenService(hSCManager, drvName.c_str(), SERVICE_START);
        }
    }

    if (!StartService(hService, 0, nullptr)) {
        if (GetLastError() != ERROR_SERVICE_ALREADY_RUNNING) {
            return false;
        }
    }

    std::wcout << L"Driver installed and started successfully!" << std::endl;
    return true;
}

// Usage
int main(int argc, char* argv[]) {
    std::wstring driverPath = L"C:\\path\\to\\beotm.sys";
    std::wstring driverName = L"BeotmDrv";

    if (!InstallBeotmDriver(driverName, driverPath)) {
        std::wcerr << L"Failed to install driver." << std::endl;
        return 1;
    }
    return 0;
}
```

--------------------------------

### Install Yara via vcpkg

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Command to install the yara dependency using the vcpkg package manager.

```powershell
.\vcpkg\vcpkg.exe install yara
```

--------------------------------

### Detect Thread Injection and Monitor Thread Creation

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This snippet includes the logic for verifying thread start addresses via VAD analysis and the notification routine for handling thread creation events.

```cpp
// Detect thread injection via VAD analysis
BOOLEAN ThreadUtils::isThreadInjected(ULONG64* addr) {
    BOOLEAN isAddressOutOfSystem32Ntdll = FALSE;
    BOOLEAN isAddressOutOfWow64Ntdll = FALSE;
    BOOLEAN isWow64 = FALSE;

    // Get thread's stack start address
    ULONG64 stackStart = stackUtils.getStackStartRtl();
    if (stackStart == NULL) {
        return FALSE;
    }

    // Check if address is in expected range
    if (((ULONG64)stackStart >> 36) != 0x7FF) {

        // Check for WoW64 process
        if (PsGetProcessWow64Process(PsGetCurrentProcess()) != NULL) {
            isWow64 = TRUE;
        }

        // Verify address against VAD tree
        this->getVadUtils()->isAddressOutOfNtdll(
            (PRTL_BALANCED_NODE)this->getVadUtils()->getVadRoot(),
            stackStart,
            &isWow64,
            &isAddressOutOfSystem32Ntdll,
            &isAddressOutOfWow64Ntdll
        );

        *addr = stackStart;

        if (isWow64) {
            // XOR check: one must be in ntdll, one out
            if (isAddressOutOfSystem32Ntdll ^ isAddressOutOfWow64Ntdll) {
                return TRUE;
            }
        } else {
            return isAddressOutOfSystem32Ntdll;
        }
    }

    return FALSE;
}

// Thread creation notification callback
VOID ThreadUtils::CreateThreadNotifyRoutine(
    HANDLE ProcessId,
    HANDLE ThreadId,
    BOOLEAN Create
) {
    if (Create) {
        ULONG64 outAddr;

        // Enable alternative syscall handler for this thread
        SyscallsUtils::SetInformationAltSystemCall(PsGetCurrentProcessId());
        SyscallsUtils::EnableAltSycallForThread(PsGetCurrentThread());

        ThreadUtils threadUtils = ThreadUtils(
            IoGetCurrentProcess(),
            PsGetCurrentThread()
        );

        // Check for process image tampering
        if (threadUtils.isProcessImageTampered()) {
            // Queue notification: "Process Image Tampering"
        }

        // Check for thread injection
        if (threadUtils.isThreadInjected(&outAddr)) {
            // Queue critical notification: "Injected Thread"
            // Address: outAddr
        }
    } else {
        // Thread terminating, disable alt syscall
        SyscallsUtils::DisableAltSycallForThread(PsGetCurrentThread());
    }
}
```

--------------------------------

### Bootstrap vcpkg

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Commands to clone and initialize the vcpkg repository.

```powershell
git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat
```

--------------------------------

### BEOTM Command Line Usage

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

These bash commands demonstrate how to run the BEOTM executable, specifying the driver path and YARA rules directory. It also shows how to stop and query the driver service.

```bash
# Basic usage
beotm.exe <path to driver> <path to Yara rules folder>
```

```bash
# Example with protection-artifacts repository
.\beotm.exe .\beotm.sys .\protection-artifacts\yara\rules\
```

```bash
# Stop the driver service manually
sc.exe stop BeotmDrv
```

```bash
# Query driver service status
sc.exe query type=driver | findstr /i "beotm"
```

--------------------------------

### Initialize YARA Engine and Load Rules

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

Compiles YARA rules from a specified directory for memory and file scanning. Expects files with a .yar extension in the target directory.

```cpp
// Initialize YARA engine and load rules
#include <yara.h>
#include <filesystem>

YR_COMPILER* compiler;
YR_RULES* rules;
YR_SCANNER* scanner = nullptr;
int yara_rules_count = 0;

VOID InitYara(char* yaraRulesPath) {
    // Initialize YARA library
    if (yr_initialize() != ERROR_SUCCESS) {
        std::cerr << "Failed to initialize Yara\n";
        return;
    }

    // Create compiler
    if (yr_compiler_create(&compiler) != ERROR_SUCCESS) {
        std::cerr << "Failed to create Yara compiler\n";
        return;
    }

    // Iterate through rules directory
    std::string rules_directory = yaraRulesPath;

    for (const auto& entry : std::filesystem::directory_iterator(rules_directory)) {
        if (entry.is_regular_file() && entry.path().extension() == ".yar") {

            FILE* rule_file;
            if (fopen_s(&rule_file, entry.path().string().c_str(), "r") != 0) {
                continue;
            }

            yara_rules_count += 1;
            printf("[+] Adding Yara rule: %s\n", entry.path().string().c_str());

            // Add rule to compiler
            yr_compiler_add_file(compiler, rule_file, NULL, entry.path().string().c_str());
            fclose(rule_file);
        }
    }

    // Compile rules
    yr_compiler_get_rules(compiler, &rules);

    // Create scanner
    yr_scanner_create(rules, &scanner);

    printf("[*] %d Yara Rules Loaded & Compiled\n", yara_rules_count);
}

// Usage
int main(int argc, char* argv[]) {
    // beotm.exe <driver path> <yara rules folder>
    InitYara("C:\\beotmv3\\protection-artifacts\\yara\\rules\\");
    return 0;
}
```

--------------------------------

### Monitor Process Creation in Kernel-Mode

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

Implements process creation callbacks to detect PPID spoofing and process ghosting, and registers the notification routine.

```cpp
// Kernel-mode process monitoring callback
#include <ntifs.h>

// Check for Parent PID Spoofing (T1134.004)
BOOLEAN ProcessUtils::isProcessParentPidSpoofed(
    PPS_CREATE_NOTIFY_INFO CreateInfo
) {
    // If the parent process ID doesn't match the creating thread's process,
    // PPID spoofing is suspected
    if (CreateInfo->ParentProcessId != CreateInfo->CreatingThreadId.UniqueProcess) {
        return TRUE;
    }
    return FALSE;
}

// Check for Process Ghosting (T1055.012)
BOOLEAN ProcessUtils::isProcessGhosted() {
    SE_AUDIT_PROCESS_CREATION_INFO* SeAuditProcessCreationInfo =
        (SE_AUDIT_PROCESS_CREATION_INFO*)((PUCHAR)this->process +
        OffsetsMgt::GetOffsets()->SeAuditProcessCreationInfo);

    if (MmIsAddressValid(SeAuditProcessCreationInfo) &&
        SeAuditProcessCreationInfo->ImageFileName != NULL) {
        // Ghosted processes have NULL image file name buffer
        if (SeAuditProcessCreationInfo->ImageFileName->Name.Buffer == NULL) {
            return TRUE;
        }
    }
    return FALSE;
}

// Process creation notification callback
VOID ProcessUtils::CreateProcessNotifyEx(
    PEPROCESS Process,
    HANDLE handle,
    PPS_CREATE_NOTIFY_INFO CreateInfo
) {
    ProcessUtils procUtils = ProcessUtils(Process);

    if (CreateInfo) {
        if (procUtils.isProcessParentPidSpoofed(CreateInfo)) {
            // Log warning: "Parent Process PID (PPID) Seems Spoofed"
            // Queue notification to user-mode
        }

        if (procUtils.isProcessGhosted()) {
            // Log critical: "Process is Ghosted!"
            // Terminate process and queue notification
        }
    }
}

// Register the callback
VOID ProcessUtils::setProcessNotificationCallback() {
    NTSTATUS status = PsSetCreateProcessNotifyRoutineEx(
        CreateProcessNotifyEx,
        FALSE  // Register callback
    );

    if (NT_SUCCESS(status)) {
        DbgPrint("[+] PsSetCreateProcessNotifyRoutineEx success\n");
    }
}
```

--------------------------------

### BEOTM Executable Usage

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Command-line usage for the BEOTM executable. It requires the path to the driver and the folder containing Yara rules.

```bash
beotm.exe <path to driver> <path to Yara rules folder>
```

```bash
.\beotm.exe .\beotm.sys .\protection-artifacts\yara\rules\
```

--------------------------------

### WinDbg Kernel Debugging Output

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Displays the initialization status of kernel callbacks and driver loading sequence in WinDbg.

```text
1: kd> g
 ____            _     _____ ____  ____     ___   __   _____ _          
| __ )  ___  ___| |_  | ____|  _ \|  _ \   / _ \ / _| |_   _| |__   ___ 
|  _ \ / _ \/ __| __| |  _| | | | | |_) | | | | | |_    | | | '_ \ / _ \
| |_) |  __/\_\ |_  | |___| |_| |  _ <  | |_| |  _|   | | | | | |  __/
|____/_\___||___/\__| |_____|____/|_| \_\  \___/|_|     |_| |_| |_|\___|     v3
|  \/  | __ _ _ __| | _____| |_                                         
| |\/| |/ _` | '__| |/ / _ \ __|                                        
| |  | | (_| | |  |   <  __/ |_           Yazidou - github.com/Xacone  
|_|  |_|\__,_|_|  |_|\_\___|\__|                                        

[+] Win Kernel Structs offsets initialized
[+] Altsyscall handler registered !
[+] PsSetCreateThreadNotifyRoutine success
[+] PsSetCreateProcessNotifyRoutineEx success
[+] PsSetLoadImageNotifyRoutine success
[+] ObRegisterCallbacks 1 success
[+] CmRegisterCallbackEx success
[+] Driver loaded
```

--------------------------------

### Register and Handle System Calls in Windows

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

Initializes the alternative syscall handler using PsRegisterAltSystemCallHandler and provides logic for intercepting specific syscalls and detecting direct syscall attempts.

```cpp
// Register alternative syscall handler
BOOLEAN SyscallsUtils::InitAltSyscallHandler() {
    UNICODE_STRING usPsRegisterAltSystemCallHandler;
    RtlInitUnicodeString(&usPsRegisterAltSystemCallHandler,
        L"PsRegisterAltSystemCallHandler");

    pPsRegisterAltSystemCallHandler = (PsRegisterAltSystemCallHandler)
        MmGetSystemRoutineAddress(&usPsRegisterAltSystemCallHandler);

    if (MmIsAddressValid(pPsRegisterAltSystemCallHandler)) {
        NTSTATUS status = pPsRegisterAltSystemCallHandler(
            (PVOID)SyscallsUtils::SyscallHandler,
            1  // Handler index
        );

        if (NT_SUCCESS(status)) {
            DbgPrint("[+] Altsyscall handler registered!\n");
            return TRUE;
        }
    }

    return FALSE;
}

// Syscall interception handler
BOOLEAN SyscallsUtils::SyscallHandler(PKTRAP_FRAME trapFrame) {
    PVOID spoofedAddr = NULL;
    ULONG id = (ULONG)trapFrame->Rax;  // Syscall ID

    // Check for stack corruption/spoofing on sensitive syscalls
    if (id == NtAllocId || id == NtWriteId || id == NtProtectId) {
        if (stackUtils->isStackCorruptedRtlCET(&spoofedAddr)) {
            // Queue warning: "Corrupted Thread Call Stack"
            return FALSE;
        }
    }

    // Extract syscall arguments from trap frame
    PULONGLONG pArg5 = (PULONGLONG)((ULONG_PTR)trapFrame->Rsp + 0x28);
    PULONGLONG pArg6 = (PULONGLONG)((ULONG_PTR)trapFrame->Rsp + 0x30);

    // Handle specific syscalls
    if (id == 0x0018) {  // NtAllocateVirtualMemory
        NtAllocVmHandler(
            (HANDLE)trapFrame->Rcx,
            (PVOID*)trapFrame->Rdx,
            trapFrame->R8,
            (SIZE_T*)trapFrame->R9,
            (ULONG)*pArg5,
            (ULONG)*pArg6
        );
    }
    else if (id == 0x003a) {  // NtWriteVirtualMemory
        isSyscallDirect(trapFrame->Rip, "NtWriteVirtualMemory");
        NtWriteVmHandler(
            (HANDLE)trapFrame->Rcx,
            (PVOID)trapFrame->Rdx,
            (PVOID)trapFrame->R8,
            (SIZE_T)trapFrame->R9,
            (PSIZE_T)*pArg6
        );
    }
    else if (id == 0x0050) {  // NtProtectVirtualMemory
        isSyscallDirect(trapFrame->Rip, "NtProtectVirtualMemory");
        NtProtectVmHandler(
            (HANDLE)trapFrame->Rcx,
            (PVOID)trapFrame->Rdx,
            (SIZE_T*)trapFrame->R8,
            (ULONG)trapFrame->R9,
            (PULONG)*pArg5
        );
    }

    return TRUE;
}

// Detect direct syscalls (not from ntdll)
BOOLEAN SyscallsUtils::isSyscallDirect(ULONG64 Rip, char* syscallName) {
    PEPROCESS curproc = IoGetCurrentProcess();
    PPS_PROTECTION procProtection = PsGetProcessProtection(curproc);

    if (procProtection->Level == 0x0) {  // Unprotected process
        KAPC_STATE apcState;
        KeStackAttachProcess(curproc, &apcState);

        BYTE op = *(BYTE*)Rip;  // Instruction at RIP

        // Check if RIP is outside ntdll.dll
        BOOLEAN isAddressOutOfSystem32Ntdll = FALSE;
        VadUtils::isAddressOutOfSpecificDll(
            (PRTL_BALANCED_NODE)root,
            (ULONG64)Rip,
            &isWow64,
            &isAddressOutOfSystem32Ntdll,
            &isAddressOutOfWow64Ntdll,
            L"\\Windows\\System32\\ntdll.dll",
            L"\\Windows\\SysWOW64\\ntdll.dll"
        );

        // If syscall from outside ntdll and RET opcode
        if (isAddressOutOfSystem32Ntdll && op == 0xC3) {
            // Queue warning: "NT Syscall did not came from Ntdll"
        }

        KeUnstackDetachProcess(&apcState);
    }

    return FALSE;
}
```

--------------------------------

### Enabling Test Signing Mode

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Configuration option for enabling test-signed code on Windows. This is a requirement for loading custom kernel drivers like BEOTM.

```powershell
The machine must be configured in "TESTSIGNING" mode.
```

--------------------------------

### Linker Additional Dependencies

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Required libraries for NDIS and TCP/IP filtering functionality in Visual Studio project properties.

```text
$(DDK_LIB_PATH)\fwpkclnt.lib
$(DDK_LIB_PATH)\ndis.lib
$(SDK_LIB_PATH)\uuid.lib
```

--------------------------------

### Querying BEOTM Driver Service

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Command to query the status of the BEOTM driver service on Windows. This helps verify if the driver service is running.

```batch
C:\Windows\system32>sc.exe query type=driver | findstr /i "beotm"
```

--------------------------------

### Object Pre-Operation Callback Handler

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This callback function is invoked before an object operation occurs. It calls `isCredentialDumpAttempt` to check for malicious activity and logs a notification if an attempt is detected. Access is managed based on the outcome of the check.

```cpp
// Pre-operation callback for object access
OB_PREOP_CALLBACK_STATUS ObjectUtils::PreOperationCallback(
    PVOID RegContext,
    POB_PRE_OPERATION_INFORMATION OpInfo
) {
    if (isCredentialDumpAttempt(OpInfo)) {
        // Queue notification: "Credential Dump Attempt"
        // Access has been blocked
    }

    return OB_PREOP_SUCCESS;
}
```

--------------------------------

### Register Registry Callback

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This C++ function registers the `RegOpNotifyCallback` to monitor registry operations. It uses a specific altitude value and requires the driver object.

```cpp
// Register registry callback
VOID RegistryUtils::setRegistryNotificationCallback() {
    UNICODE_STRING altitude = RTL_CONSTANT_STRING(L"300021");

    NTSTATUS status = CmRegisterCallbackEx(
        RegistryUtils::RegOpNotifyCallback,
        &altitude,
        CallbackObjects::GetDriverObject(),
        NULL,
        &cookie,
        NULL
    );

    if (NT_SUCCESS(status)) {
        DbgPrint("[+] CmRegisterCallbackEx success\n");
    }
}
```

--------------------------------

### Capture Memory Buffers for YARA Scanning

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This C++ handler is triggered when `NtProtectVirtualMemory` is called with execute permissions. It copies the memory buffer and queues it for user-mode YARA scanning.

```cpp
// Capture memory buffers for YARA scanning
VOID SyscallsUtils::NtProtectVmHandler(
    HANDLE ProcessHandle,
    PVOID BaseAddress,
    SIZE_T* NumberOfBytesToProtect,
    ULONG NewAccessProtection,
    PULONG OldAccessProtection
) {
    // Check for execute permissions being set
    if (NewAccessProtection & PAGE_EXECUTE) {

        PVOID buffer = ExAllocatePool2(POOL_FLAG_NON_PAGED,
            *NumberOfBytesToProtect, 'msg');

        if (buffer) {
            // Copy memory region
            RtlCopyMemory(buffer, BaseAddress, *NumberOfBytesToProtect);

            RAW_BUFFER rawBuf;
            rawBuf.buffer = (BYTE*)buffer;
            rawBuf.size = *NumberOfBytesToProtect;
            rawBuf.pid = PsGetProcessId(PsGetCurrentProcess());
            RtlCopyMemory(rawBuf.procName,
                PsGetProcessImageFileName(PsGetCurrentProcess()), 15);

            // Queue buffer for user-mode YARA scanning
            if (!CallbackObjects::GetBytesQueue()->Enqueue(rawBuf)) {
                ExFreePool(rawBuf.buffer);
            }
        }
    }
}
```

--------------------------------

### Check for Persistence-Like Registry Operations

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This C++ function checks if a given registry path matches common auto-run keys used for persistence. It's used within the registry operation notification callback.

```cpp
// Check for persistence-like registry operations
BOOLEAN RegistryUtils::isRegistryPersistenceBehavior(
    PUNICODE_STRING regPath
) {
    // Monitor auto-run registry keys (T1547.001)
    if (UnicodeStringContains(regPath, L"\CurrentVersion\Run") ||
        UnicodeStringContains(regPath, L"\CurrentVersion\RunOnce") ||
        UnicodeStringContains(regPath, L"\CurrentVersion\RunOnce\Setup")) {
        return TRUE;
    }

    return FALSE;
}
```

--------------------------------

### Registry Operation Notification Callback

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This C++ function serves as the callback for registry operations. It intercepts pre-create key events, checks for persistence-like behaviors, and queues a warning if detected.

```cpp
// Registry operation notification callback
NTSTATUS RegistryUtils::RegOpNotifyCallback(
    PVOID CallbackContext,
    PVOID Arg1,
    PVOID Arg2
) {
    REG_NOTIFY_CLASS regNotifyClass = (REG_NOTIFY_CLASS)(ULONG_PTR)Arg1;

    switch (regNotifyClass) {
    case RegNtPreCreateKeyEx: {
        PREG_POST_OPERATION_INFORMATION queryKeyInfo =
            (PREG_POST_OPERATION_INFORMATION)Arg2;

        if (queryKeyInfo && queryKeyInfo->Object &&
            MmIsAddressValid(queryKeyInfo->Object)) {

            PCUNICODE_STRING regPath;
            CmCallbackGetKeyObjectIDEx(
                &cookie,
                queryKeyInfo->Object,
                NULL,
                &regPath,
                0
            );

            if (isRegistryPersistenceBehavior((PUNICODE_STRING)regPath)) {
                // Queue warning: "Persistence-Like Registry Operation"
            }
        }
        break;
    }
    }

    return STATUS_SUCCESS;
}
```

--------------------------------

### Register Object Notification Callback

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This function registers a callback for object operations, specifically for handle creation on processes. It configures the callback to monitor access to `lsass.exe` and uses the `PreOperationCallback` to handle potential credential dumping attempts.

```cpp
// Register object callbacks
VOID ObjectUtils::setObjectNotificationCallback() {
    OB_CALLBACK_REGISTRATION objOpCallbackRegistration;
    OB_OPERATION_REGISTRATION regPreOpRegistration;

    regPreOpRegistration.ObjectType = PsProcessType;
    regPreOpRegistration.Operations = OB_OPERATION_HANDLE_CREATE;
    regPreOpRegistration.PreOperation = PreOperationCallback;
    regPreOpRegistration.PostOperation = NULL;

    objOpCallbackRegistration.Version = OB_FLT_REGISTRATION_VERSION;
    objOpCallbackRegistration.OperationRegistrationCount = 1;
    objOpCallbackRegistration.Altitude = altitude;
    objOpCallbackRegistration.RegistrationContext = NULL;
    objOpCallbackRegistration.OperationRegistration = &regPreOpRegistration;

    ObRegisterCallbacks(&objOpCallbackRegistration, &regHandle);
}
```

--------------------------------

### User-mode YARA Callback for Byte Streams

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This C++ function is a YARA callback for byte streams. Upon detecting a rule match, it extracts the process ID, attempts to terminate the process, and logs the event.

```cpp
// User-mode YARA callback for byte streams
int yr_callback_function_byte_stream(
    YR_SCAN_CONTEXT* context,
    int message,
    void* message_data,
    void* user_data
) {
    if (message == CALLBACK_MSG_RULE_MATCHING) {
        PKERNEL_STRUCTURED_BUFFER structBuffer = (PKERNEL_STRUCTURED_BUFFER)user_data;

        UINT32 pid = (UINT32)structBuffer->pid;
        std::string rule_identifier =
            std::string(((YR_RULE*)message_data)->identifier);

        // Terminate malicious process
        DWORD bytesReturned;
        BOOL endRes = DeviceIoControl(
            hBeotmDevice,
            END_THAT_PROCESS,
            &pid,
            sizeof(pid),
            nullptr, 0,
            &bytesReturned,
            nullptr
        );

        // Log detection event
        printf("[!] YARA Match: %s | PID: %d | Process %s\n",
            rule_identifier.c_str(), pid,
            endRes ? "terminated" : "termination failed");
    }

    return CALLBACK_CONTINUE;
}
```

--------------------------------

### Communicate with Kernel Driver via IOCTL

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

Defines IOCTL codes and provides functions for retrieving data from the driver and terminating processes from user-mode.

```cpp
// IOCTL codes for driver communication
#define BEOTM_RETRIEVE_DATA_BUFFER CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define BEOTM_RETRIEVE_DATA_FILE   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define BEOTM_RETRIEVE_DATA_BYTE   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define END_THAT_PROCESS           CTL_CODE(FILE_DEVICE_UNKNOWN, 0x216, METHOD_BUFFERED, FILE_ANY_ACCESS)

HANDLE hBeotmDevice;

void ConsumeIOCTLData(LPCWSTR deviceName, DWORD ioctlCode, int sleepDurationMs) {
    // Open device handle
    hBeotmDevice = CreateFileW(
        L"\\.\\Beotm",
        GENERIC_WRITE,
        0,
        nullptr,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        nullptr
    );

    if (hBeotmDevice == INVALID_HANDLE_VALUE) {
        std::cerr << "Failed to open device" << std::endl;
        return;
    }

    DWORD bufferSize = 1024 * 1024;  // 1MB buffer
    BYTE* buffer = (BYTE*)malloc(bufferSize);

    while (true) {
        DWORD bytesReturned = 0;

        // Retrieve data from driver
        BOOL result = DeviceIoControl(
            hBeotmDevice,
            ioctlCode,
            nullptr, 0,
            buffer, bufferSize,
            &bytesReturned,
            nullptr
        );

        if (result && bytesReturned > 0) {
            // Process notification data
            PKERNEL_STRUCTURED_NOTIFICATION notif = (PKERNEL_STRUCTURED_NOTIFICATION)buffer;

            // Handle detection event...
            printf("[Alert] PID: %d | %s\n", notif->pid, notif->procName);
        }

        Sleep(sleepDurationMs);
    }

    free(buffer);
    CloseHandle(hBeotmDevice);
}

// Terminate a malicious process
void TerminateMaliciousProcess(UINT32 pid) {
    DWORD bytesReturned;

    BOOL result = DeviceIoControl(
        hBeotmDevice,
        END_THAT_PROCESS,
        &pid,
        sizeof(pid),
        nullptr, 0,
        &bytesReturned,
        nullptr
    );

    if (result) {
        printf("[+] Process %d terminated\n", pid);
    }
}
```

--------------------------------

### Detect Credential Dump Attempts

Source: https://context7.com/xacone/bestedrofthemarket/llms.txt

This function checks for attempts to dump credentials from LSASS. It verifies if the target process is lsass.exe and if the calling process is unprotected and attempting to read LSASS memory. Access is restricted to termination only if a dump attempt is detected.

```cpp
// Detect credential dump attempts targeting LSASS
BOOLEAN ObjectUtils::isCredentialDumpAttempt(
    POB_PRE_OPERATION_INFORMATION OpInfo
) {
    PEPROCESS targetProc = (PEPROCESS)OpInfo->Object;
    PUNICODE_STRING targetImageFileName;
    SeLocateProcessImageName(targetProc, &targetImageFileName);

    // Check if targeting different process
    if (PsGetProcessId(targetProc) != PsGetProcessId(IoGetCurrentProcess())) {

        // Check if target is LSASS
        if (UnicodeStringContains(targetImageFileName, L"lsass.exe")) {

            if (OpInfo->Operation == OB_OPERATION_HANDLE_CREATE) {

                PEPROCESS callingProc = PsGetCurrentProcess();
                PPS_PROTECTION callingProcProtection = PsGetProcessProtection(callingProc);

                int accessMask = OpInfo->Parameters->CreateHandleInformation.DesiredAccess;

                // Unprotected process trying to read LSASS memory
                if (callingProcProtection->Level == 0x0) {
                    if (accessMask & PROCESS_VM_READ) {
                        // Strip access, only allow terminate
                        OpInfo->Parameters->CreateHandleInformation.DesiredAccess = PROCESS_TERMINATE;
                        return TRUE;
                    }
                }
            }
        }
    }

    return FALSE;
}
```

--------------------------------

### Stopping BEOTM Driver Service

Source: https://github.com/xacone/bestedrofthemarket/blob/main/README.md

Command to stop the BEOTM driver service on Windows. This is useful for managing the EDR driver's lifecycle.

```batch
C:\Windows\system32> sc.exe stop BeotmDrv 
```
Tokens:
Raw