MemGuard — Zero-Abhängigkeits-Windows-EDR-Dienstprogramm, das unbefugten LSASS-Speicherzugriff, Handle-Duplizierung und LOLBin-Credential-Dumping in Echtzeit erkennt und abwehrt. | Kitploit

lsass.exe

flowchart TD
    subgraph Host ["Windows 11 / 10 Endpoint"]
        Adversary["Attacker / LOLBin / Mimikatz / ProcDump"] -- OpenProcess (PROCESS_VM_READ) --> LSASS["lsass.exe (PID: 1744)"]
        
        subgraph MemGuard ["MemGuard Defensive Engine"]
            HScan["NtQuerySystemInformation\n(SystemExtendedHandleInformation)"] --> CheckMask{"Access Mask\nAnalysis"}
            CheckMask -- "VM_READ / ALL_ACCESS" --> Alert1["🚨 Critical Alert:\nUnauthorized Handle"]
            
            PEBScan["Process PEB Reader\n(NtQueryInformationProcess)"] --> LOLBinCheck{"CommandLine\nRegex Engine"}
            LOLBinCheck -- "comsvcs.dll / procdump" --> Alert2["🚨 Critical Alert:\nLOLBin Dump Attempt"]
            
            DumpWatch["Triage Directory\nArtifact Scanner"] --> MDMPCheck{"MDMP Header\nValidation"}
            MDMPCheck -- "Valid LSASS .dmp" --> Alert3["🚨 Alert:\nRogue Dump File"]
            
            Alert1 & Alert2 --> Mitigation["Active Mitigation:\nNtSuspendProcess (Freeze)"]
        end
    end

# Monitor system every 3 seconds
python memguard.py --monitor --interval 3

# Monitor with automatic active mitigation (freeze dumper processes)
python memguard.py --monitor --interval 2 --suspend

███╗   ███╗███████╗███╗   ███╗ ██████╗ ██╗   ██╗ █████╗ ██████╗ ██████╗ 
████╗ ████║██╔════╝████╗ ████║██╔════╝ ██║   ██║██╔══██╗██╔══██╗██╔══██╗
██╔████╔██║█████╗  ██╔████╔██║██║  ███╗██║   ██║███████║██████╔╝██║  ██║
██║╚██╔╝██║██╔══╝  ██║╚██╔╝██║██║   ██║██║   ██║██╔══██║██╔══██╗██║  ██║
██║ ╚═╝ ██║███████╗██║ ╚═╝ ██║╚██████╔╝╚██████╔╝██║  ██║██║  ██║██████╔╝
╚═╝     ╚═╝╚══════╝╚═╝     ╚═╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝ 
Zero-Dependency LSASS Memory Dump Shield & EDR Hook Detector | Pure Python
► MITRE ATT&CK: T1003.001 (OS Credential Dumping: LSASS Memory)
    
[*] Privilege Level: Elevated (Administrator) - Full Kernel Handle Access
[*] SeDebugPrivilege Status: Enabled Successfully
[*] Target Security Process Found: lsass.exe (PID: 1744) | Path: C:\Windows\System32\lsass.exe

--- LSASS Handle Table Audit (NtQuerySystemInformation) ---
  ✓ No unauthorized or suspicious handles targeting LSASS detected.

--- Process Heuristics & LOLBin CommandLine Inspection ---
  ✓ No credential dumping processes or LOLBin signatures found.

--- Dump File Artifacts & Honeypot Tripwire ---
  ✓ No rogue memory dump (.dmp) files identified in triage directories.

Audit Summary: 0 handle threats, 0 process threats, 0 dump artifacts.

MemGuard/
├── memguard.py              # Main CLI entry point & real-time monitoring loop
├── core/
│   ├── __init__.py
│   ├── win_api.py           # Native Win32/NT kernel ctypes prototypes & PEB reader
│   ├── handle_scanner.py    # NtQuerySystemInformation handle table & access mask auditor
│   ├── process_auditor.py   # Heuristic LOLBin cmdline inspection & parent verification
│   └── honey_dmp.py         # MiniDump (.dmp) artifact validator
├── LICENSE                  # MIT License
├── README.md                # Technical Documentation
└── requirements.txt         # Zero dependencies notice

MemGuard

Beliebteste

⚙️ Architektur & technische Funktionsweise

1. NT-Kernel-Handle-Enumeration

2. Access-Mask-Bitfeld-Dekodierung

3. Reiner Python-PEB-Kommandozeilen-Leser

4. Aktives Einfrieren von Bedrohungen (`NtSuspendProcess`)

🚀 Installation & Verwendung

1. Einmaliger Sicherheits-Triage-Scan

2. Kontinuierlicher Echtzeit-EDR-Schutzmodus

3. Forensischen Vorfallbericht exportieren (JSON)

4. Zweisprachige CLI-Unterstützung (Englisch / Türkisch)

📸 Beispielhafte Terminal-Ausgabe

🛠️ Projektstruktur

👤 Autor

⚖️ Lizenz