You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I think it would be nice if there would be a verbose mode where we would get more infos regarding the warning/alert.
As an example: Right now, I can only see "Method: Stack Base + VAD Inspection | Injected Thread" for a process injection, but not what telemetry BEOTM used to gather the neccessary infos and trigger the decetion (e.g. the kernel callback "PsSetCreateThreadNotifyRoutine" was used for the detection or ETWti).
The text was updated successfully, but these errors were encountered:
There's no ETW-TI in BEOTM for the time being; the sole code injection detection mechanism is the VAD + Stack Inspection, which is done once a thread is created.
Soon the client process (FTXUI) will disappear and I'll replace it with a web interface where much more telemetry information will be displayed and browsable.
I think it would be nice if there would be a verbose mode where we would get more infos regarding the warning/alert.
As an example: Right now, I can only see "Method: Stack Base + VAD Inspection | Injected Thread" for a process injection, but not what telemetry BEOTM used to gather the neccessary infos and trigger the decetion (e.g. the kernel callback "PsSetCreateThreadNotifyRoutine" was used for the detection or ETWti).
The text was updated successfully, but these errors were encountered: