From df5d6d8d88d11c5034813364e62fceb1be916ff0 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 25 Oct 2022 13:23:54 +0000 Subject: [PATCH] Add documentation to plugin --- .../plugins/windows/driver_signing_enforcement.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/volatility3/framework/plugins/windows/driver_signing_enforcement.py b/volatility3/framework/plugins/windows/driver_signing_enforcement.py index 35b2c7ea7..161d4fcb6 100644 --- a/volatility3/framework/plugins/windows/driver_signing_enforcement.py +++ b/volatility3/framework/plugins/windows/driver_signing_enforcement.py @@ -12,6 +12,19 @@ from volatility3.framework.symbols.windows import pdbutil vollog = logging.getLogger(__name__) +""" +A common technique by modern Windows rootkits is disabling Driver Signing Enforcement so that +unsigned kernel rootkits can load. Rapid 7 documented many examples here: + +https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/ + +To disable DSE, malware will set the `g_CiOptions` global variable in the kernel to 0. + +This plugin locates this variable in memory and then reports its status and value. + +If this global variable is disabled on Windows 10 systems then it means the system is either in +developer mode or that a rootkit purposely overwrote the value. Neither would be expected in production settings. +""" class driver_signing_enforcement(interfaces.plugins.PluginInterface): """Reports the status of Driving Signing Enforcement"""