Thread by @d_olex

So, what's wrong with #CosmicStrand UEFI implant from the first glance on its sample? What exactly lessons APT malware developers can learn from open source projects? 🧵⬇️

https://twitter.com/d_olex/status/1551596188503224320

First, it is really trivial to detect this malware presence by patched nt!KiFilterFiberContext() function in order to disable PatchGuard. My UEFI rootkit is not interfering with PatchGuard at all, it also not using any permanent in-memory patches or callbacks, only temporary ones

Second, while #CosmicStrand is using pretty much standard set of hooks to hijack execution flow of the bootloader and kernel, like OslArchTransferToKernel() and so on, there's a lack of Hyper-V/HVCI presence checks in its boot stage code which is really bad ...

What happens when such boot stage hooks are going to be executed in the context of the hypervisor on Virtualization-Based Security enabled machine? It will just BSoD the box by passing an execution to the invalid code page that Hyper-V is not aware about

Since it is not that trivial to support such configurations, my UEFI rootkit is using simple check to detect enabled Hyper-V and continue an execution without causing any damage to the system. This is important check if you want to use old fashioned techniques on modern systems

I haven't performed an actual and complete analysis of #CosmicStrand sample, issues described above is just the first thing that catches your eye. I'm almost sure that its code will bring many other bugs and disadvantages if you will check it more closely

Hey, @mfa_china, you can just rip off my code to use your taxpayer money more effective 😂