Check if an operation is on a remote process. This is called by suspicious operation callbacks such as Thread Creation. @param DetectionSource - The filter we are checking the stack of. @param UserPtr - The pointer to check. @param SourceProcessId - The source of the audit. @param SourceProcessId - The target of the operation. @param SourcePath - The source path. @param TargetPath - The targ
| 214 | @param StackHistorySize - Size of the StackHistory array. |
| 215 | */ |
| 216 | VOID |
| 217 | DetectionLogic::AuditCallerProcessId( |
| 218 | _In_ DETECTION_SOURCE DetectionSource, |
| 219 | _In_ HANDLE CallerProcessId, |
| 220 | _In_ HANDLE TargetProcessId, |
| 221 | _In_ PUNICODE_STRING SourcePath, |
| 222 | _In_ PUNICODE_STRING TargetPath, |
| 223 | _In_ STACK_RETURN_INFO StackHistory[], |
| 224 | _In_ ULONG StackHistorySize |
| 225 | ) |
| 226 | { |
| 227 | ULONG stackHistoryBytes; |
| 228 | PREMOTE_OPERATION_ALERT remoteOperationAlert; |
| 229 | |
| 230 | // |
| 231 | // If the operation is on the current process, no problems! |
| 232 | // |
| 233 | if (CallerProcessId == TargetProcessId) |
| 234 | { |
| 235 | return; |
| 236 | } |
| 237 | |
| 238 | // |
| 239 | // Calculate the size of the StackHistory array in bytes. |
| 240 | // |
| 241 | stackHistoryBytes = sizeof(STACK_RETURN_INFO) * (StackHistorySize - 1); |
| 242 | |
| 243 | // |
| 244 | // Allocate space for the alert depending on the size of StackHistory. |
| 245 | // |
| 246 | remoteOperationAlert = RCAST<PREMOTE_OPERATION_ALERT>(ExAllocatePoolWithTag(PagedPool, sizeof(REMOTE_OPERATION_ALERT) + stackHistoryBytes, STACK_VIOLATION_TAG)); |
| 247 | if (remoteOperationAlert == NULL) |
| 248 | { |
| 249 | DBGPRINT("DetectionLogic!PushStackViolationAlert: Failed to allocate space for the alert."); |
| 250 | return; |
| 251 | } |
| 252 | memset(remoteOperationAlert, 0, sizeof(REMOTE_OPERATION_ALERT) + stackHistoryBytes); |
| 253 | |
| 254 | // |
| 255 | // Fill the fields of the alert. |
| 256 | // |
| 257 | switch (DetectionSource) |
| 258 | { |
| 259 | case ProcessCreate: |
| 260 | remoteOperationAlert->AlertInformation.AlertType = ParentProcessIdSpoofing; |
| 261 | break; |
| 262 | case ThreadCreate: |
| 263 | remoteOperationAlert->AlertInformation.AlertType = RemoteThreadCreation; |
| 264 | break; |
| 265 | } |
| 266 | remoteOperationAlert->AlertInformation.AlertSource = DetectionSource; |
| 267 | remoteOperationAlert->AlertInformation.SourceId = CallerProcessId; |
| 268 | remoteOperationAlert->RemoteTargetId = TargetProcessId; |
| 269 | |
| 270 | if (SourcePath) |
| 271 | { |
| 272 | RtlStringCbCopyUnicodeString(remoteOperationAlert->AlertInformation.SourcePath, MAX_PATH, SourcePath); |
| 273 | } |
no test coverage detected