04/24/2018, 11:46 PM
I've commented on the existing ticket to add support for enumerating named mutex objects on Windows. The ticket is at https://github.com/facebook/osquery/issues/2754 I put the following comment in the ticket just now: --BEGIN-- I have created an entirely uninteresting proof-of-concept on HANDLE enumeration across all processes. This is done in usermode (no custom kernel module) using a series of reasonably well-known techniques, man of which date back well over a decade. The proof-of-concept can be found on github at https://github.com/scottlundgren/objects/blob/master/objects/objects/objects.cpp I have provided example output below. The proof-of-concept does no filtering by itself - it simply enumerate all HANDLEs across the system, looks up the name associated with the object the HANDLE references, and outputs several interesting fields including the PID, the HANDLE value, the object type number and name (mutex, file, registry key, window station, etc.) and the object name itself (the filename, the mutex name, the registry key name). By running the proof-of-concept and piping to grep, it is easy to see how the results could be filtered down to just mutexes with a name matching a certain pattern. The next step is to implement a proof-of-concept in osquery itself. --END--
11:48 PM
My plan for tomorrow is to put together an implementation in osquery itself in the form of a virtual table. I don't mind doing extra work, so I'm not asking for any assurances, I'm just looking for feedback. My plan is to follow the docs on adding a virtual table and then drop the logic I put together in the proof-of-concept above and then ask for some feedback.
11:49 PM
does that sound like a reasonable plan?
11:51 PM
I'm also happy to put together a simple doc describing the approach, the pros and cons of the approach, etc. if that would help.