Windows

LimaCharlie's Windows sensor is one of the EDR-class sensors. It interfaces with the kernel to acquire deep visibility into the host's activity while taking measures to preserve the host's performance.

Supports Windows XP 32 bit and up.

Installation Instructions

Sensor installation instructions can be found here.

Supported Events

• AUTORUN_CHANGE
• CLOUD_NOTIFICATION
• CODE_IDENTITY
• CONNECTED
• DATA_DROPPED
• DISCONNECTED
• DNS_REQUEST
• DRIVER_CHANGE
• EXISTING_PROCESS
• FILE_CREATE
• FILE_DELETE
• FILE_MODIFIED
• FILE_TYPE_ACCESSED
• FIM_ADD
• FIM_HIT
• HIDDEN_MODULE_DETECTED
• MODULE_LOAD
• MODULE_MEM_DISK_MISMATCH
• NETWORK_CONNECTIONS
• NETWORK_SUMMARY
• NEW_DOCUMENT
• NEW_NAMED_PIPE
• NEW_PROCESS
• NEW_REMOTE_THREAD
• NEW_TCP4_CONNECTION
• NEW_UDP4_CONNECTION
• NEW_TCP6_CONNECTION
• NEW_UDP6_CONNECTION
• OPEN_NAMED_PIPE
• PROCESS_ENVIRONMENT
• RECEIPT
• REGISTRY_CREATE
• REGISTRY_DELETE
• REGISTRY_WRITE
• REMOTE_PROCESS_HANDLE
• SENSITIVE_PROCESS_ACCESS
• SERVICE_CHANGE
• SHUTTING_DOWN
• STARTING_UP
• TERMINATE_PROCESS
• TERMINATE_TCP4_CONNECTION
• TERMINATE_UDP4_CONNECTION
• TERMINATE_TCP6_CONNECTION
• TERMINATE_UDP6_CONNECTION
• THREAD_INJECTION
• USER_OBSERVED
• VOLUME_MOUNT
• VOLUME_UNMOUNT
• WEL
• YARA_DETECTION

Supported Commands

• artifact_get
• deny_tree
• dir_find_hash
• dir_list
• dns_resolve
• doc_cache_get
• exfil_add
• exfil_del
• exfil_get
• file_del
• file_get
• file_hash
• file_info
• file_mov
• fim_add
• fim_del
• fim_get
• hidden_module_scan
• history_dump
• mem_find_handle
• mem_find_string
• mem_handles
• mem_map
• mem_read
• mem_strings
• netstat
• os_autoruns
• os_drivers
• os_kill_process
• os_packages
• os_processes
• os_resume
• os_services
• os_suspend
• os_users
• os_version
• put
• reg_list
• rejoin_network
• restart
• run
• segregate_network
• set_performance_mode
• uninstall
• yara_scan
• yara_update

Artifacts

Given configured paths to collect from, the Windows sensor can batch upload logs / artifacts directly from the host.

Learn more about collecting Artifacts here.

Payloads

For more complex needs not supported by Events, Artifacts, or Commands, it's possible to execute payloads on hosts via the Windows sensor.

Learn more about executing Payloads here.

Microsoft Defender

The Windows sensor can listen, alert, and automate based on various Defender events.

This is done by ingesting artifacts from the Defender Event Log Source and using Detection & Response rules to take the appropriate action.

A config template to alert on the common Defender events of interest is available here. The template can be used in conjunction with Infrastructure Service or its user interface in the web app.

Specifically, the template alerts on the following Defender events:

• windows-defender-malware-detected (event ID 1006)
• windows-defender-history-deleted (event ID 1013)
• windows-defender-behavior-detected (event ID 1015)
• windows-defender-activity-detected (event ID 1116)