lloydlabs/process-enumeration-stealthStealth Windows process enumeration PoC that lists PIDs using NTFS via NtQueryInformationFile, bypassing standard monitoring APIs and enabling EDR evasion during red team operations.
This is a simple PoC which allows you to return a list of PIDs currently using NTFS, by querying the \ntfs\ base device (the Windows filesystem base object). Using this method circumvents the need to use typical APIs, such as NtQuerySystemInformation or the higher level EnumProcesses. Using this non-typical reconnaissance method could allow operators to evade typical monitoring on endpoints 🎉. Thank you to Jonas Lyk for originally finding this trick.
\ntfs\ with GENERIC_READ | SYNCHRONIZEFileProcessIdsUsingFileInformation class using the NtQueryInformationFile APIPFILE_PROCESS_IDS_USING_FILE_INFORMATION list of process IDsIf you wish to contact me quicker, feel free to on Twitter or e-mail.