Hunt-Weird-Syscalls

Hunt-Weird-Syscalls 这是一个基于 ETW 的 POC，用于监控异常系统调用（syscall）。 目前，监控 NtOpenThread 和 NtSetContextThread 这两个系统调用，以识别表明直接 和间接 系统调用的 IOC。 描述 该项目使用 ETW，更准确地说是基于内核的 ETW 提供程序，来监控 IOC。 内核中的 ETW 提供程序可以被有效利用，因为所发出事件的调用跟踪（calltrace）包含执行系统调用时的用户态地址。 这样可以监控表明直接和间接系统调用的 IOC，这是一种常被威胁行为者利用的技术： 1:...

CVE-2007-5086

CVE-2007-5086 concerns Kaspersky Anti-Virus/Internet Security 7.0.0.125 where SSDT and Shadow SSDT parameter validation is insufficient, enabling local users to trigger a crash (DoS) via kernel hooks in kylif.sys (NtUserSendInput, LoadLibraryA, NtOpenProcess, NtOpenThread, NtTerminateProcess, NtU...

CVE-2007-4967

Online Armor Personal Firewall 2.0.1.215 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API...

Code injection

Privatefirewall 5.0.14.2 does not properly validate certain parameters to System Service Descriptor Table SSDT function handlers, which allows local users to cause a denial of service crash and possibly gain privileges via kernel SSDT hooks for 1 NtOpenProcess and 2 NtOpenThread...

CVE-2007-4968

CVE-2007-4968 – Normal mode \n\nAffected product: Privatefirewall 5.0.14.2.\nWhat is vulnerable: the system service descriptor table (SSDT) function handlers are not properly validated for certain parameters, enabling an attacker with local access to trigger a denial of service (crash) and potent...

Code injection

cmdmon.sys in Comodo Firewall Pro formerly Comodo Personal Firewall 2.4.16.174 and earlier does not validate arguments that originate in user mode for the 1 NtCreateSection, 2 NtOpenProcess, 3 NtOpenSection, 4 NtOpenThread, and 5 NtSetValueKey hooked SSDT functions, which allows local users to...