Listen to this Post
Introduction:
Endpoint Detection and Response (EDR) solutions are a cornerstone of modern enterprise security, yet their inner workings are often opaque. A common technique EDRs employ is the use of file system minifilters to monitor system activity in real-time. This article delves into the forensic artifacts these drivers leave behind, specifically the filter communication ports, and provides a technical guide for security professionals to identify and analyze them.
Learning Objectives:
- Understand the role of file system minifilter drivers in EDR operation.
- Learn to enumerate loaded kernel minifilters and their associated communication ports on a Windows system.
- Develop the skills to analyze these artifacts to assess EDR presence and behavior.
You Should Know:
1. Enumerating Loaded Kernel Minifilters
The first step in detecting EDR minifilters is to list all drivers currently loaded in the kernel. The `fltmc` (Filter Manager Control) utility is the native Windows tool for this task.
`fltmc filters`
Step-by-step guide:
This command queries the Filter Manager and returns a list of all loaded minifilter drivers. The output includes the filter name, its altitude (a numerical value that determines the order in which filters process I/O operations), and the number of instances. EDRs and antivirus products will appear in this list. Execute this command from an elevated Command Prompt or PowerShell to get a complete listing. Analyzing the list can reveal security products that may not be visible through standard process lists.
- Listing All Filter Driver Instances and Their Volumes
To get more detailed information, including which volumes each filter is attached to, use the `fltmc instances` command. This reveals the scope of the driver’s monitoring.
`fltmc instances`
Step-by-step guide:
Running this command provides a comprehensive view of each minifilter instance, showing the filter name, its altitude, the volume name it is attached to (e.g., C:), and the instance name. This is crucial for understanding whether an EDR is monitoring all storage volumes or has a targeted focus on specific drives.
3. Identifying Filter Communication Ports
Minifilters often establish communication ports to talk to their user-mode services. These named objects in the `\FileSystem\Filters` directory are a key artifact. The PowerShell `Get-ChildItem` cmdlet can enumerate them.
`Get-ChildItem ‘\FileSystem\Filters’`
Step-by-step guide:
This PowerShell command lists the objects within the Object Manager’s `\FileSystem\Filters` directory. Here, you will find named filter communication ports, which often correspond to loaded minifilters. The presence of a port with a name matching a known EDR vendor is a strong indicator of its activity on the system.
4. Inspecting Specific Filter Communication Ports with WinObj
While PowerShell can list the objects, Sysinternals’ WinObj provides a graphical interface to inspect the security descriptors and details of these ports, which is vital for understanding access control.
`WinObj.exe` (Navigate manually to `\FileSystem\Filters`)
Step-by-step guide:
Download and run WinObj from the Microsoft Sysinternals suite. Run it as Administrator. In the Object Manager tree, navigate to \FileSystem\Filters. This window will display all Filter Communication Ports. Right-clicking on a port and selecting “Properties” allows you to examine its security descriptor, revealing which user accounts or processes have permissions to connect to the port—a critical piece of information for both attackers and defenders.
5. Auditing with Windows Event Logs
The Windows Filter Manager logs key events related to minifilter activity. These logs can be queried to audit driver load operations, which is essential for compliance and threat hunting.
`Get-WinEvent -FilterHashtable @{LogName=’System’; ID=1} | Where-Object Message -like “FltMgr”`
Step-by-step guide:
This PowerShell command retrieves events from the System log with Event ID 1 (which typically indicates a driver has been loaded) and filters the results for messages containing “FltMgr,” the Filter Manager. Reviewing these events provides a historical record of when minifilter drivers were loaded, which can be correlated with system changes or potential malicious activity.
6. Investigating Driver Files on Disk
Once a suspicious minifilter is identified via fltmc, the next step is to locate its actual driver file (.sys) on disk for further analysis, such as hashing or submission to a sandbox.
`Get-WinEvent -FilterHashtable @{LogName=’System’; ID=1; ProviderName=’Microsoft-Windows-Kernel-Boot’} | Select-Object -ExpandProperty Message`
Step-by-step guide:
This command is a starting point. The System event log records driver load events. The message for Event ID 1 from the kernel boot provider often contains the full path to the loaded driver file (e.g., \SystemRoot\system32\drivers\xxxx.sys). Cross-reference the driver name from `fltmc` with these paths to locate the file for offline analysis.
7. Advanced Forensic Analysis with Volatility
For memory forensics on a captured RAM image, the Volatility Framework’s `malfind` and `driverscan` commands can uncover hidden or unlinked minifilter drivers that may be attempting to evade live system enumeration.
`volatility -f memory.dump –profile=Win10x64_19041 driverscan`
`volatility -f memory.dump –profile=Win10x64_19041 malfind`
Step-by-step guide:
After acquiring a memory image, use the `driverscan` plugin to enumerate kernel drivers, including those that might be hidden. The `malfind` plugin helps identify injected code sections within kernel memory. Correlating the output of these plugins with the live system data from `fltmc` can reveal rootkits or advanced malware that hijacks or masquerades as legitimate filter drivers.
What Undercode Say:
- The presence of a filter communication port that only allows a single connection is a high-fidelity indicator of an EDR’s user-mode and kernel-mode components linking up, a design choice for security and integrity.
- Forensic enumeration of minifilters is a fundamental skill for both blue teams building baselines and red teams conducting reconnaissance and developing evasion tactics.
The technical deep dive into EDR minifilters underscores a critical arms race in cybersecurity. As EDRs leverage deeper kernel integration for visibility, adversaries are forced to develop more sophisticated techniques to evade detection, such as direct system call manipulation and memory-only malware. This analysis is not just academic; it’s a practical necessity for effective threat hunting, incident response, and penetration testing. Understanding these underlying mechanisms allows defenders to better validate their security controls and enables offensive researchers to rigorously test them, ultimately driving the entire industry toward more resilient security architectures.
Prediction:
The continued evolution of EDR bypass techniques will push vendors toward deeper kernel integration, potentially adopting methods currently seen in rootkits. This will likely lead to an increased focus on securing the kernel itself, with technologies like Kernel Data Protection (KDP) and Hypervisor-Protected Code Integrity (HVCI) becoming standard requirements. Furthermore, the line between EDRs and kernel-level anti-cheat software will continue to blur, raising significant questions about privacy, system performance, and the security of the kernel attack surface itself.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Jonathan Reiter – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
