0xjbb/SuspiciousThreads

## 可疑 Threads 这是一个仅使用 ETW 来狩猎可疑线程创建事件的 Poc 尝试。它目前可以识别： - Unbacked 线程创建调用 - Unbacked StartAddress - 基于 JOP 的 StartAddress 编写此项目的主要原因是为了探究是否有可能检测到基于 JOP/gadget 的 StartAddress，例如 `jmp rcx`， 它的实现方式是获取远程模块的 pdata，并检查其中是否存在对应的条目，以及该 StartAddress 是否位于该条目范围内但并非 BeginAddress。 - Unbacked 检查在 JIT 应用程序（例如 .net、Java 等）中会产生误报（FP）。 ### 编译 生成： ``` cmake -G "Visual Studio 18 2026" -A x64 -B build -- Selecting Windows SDK version 10.0.26100.0 to target Windows 10.0.26200. -- The C compiler identification is MSVC 19.51.36244.0 -- The CXX compiler identification is MSVC 19.51.36244.0 -- Detecting C compiler ABI info -- Detecting C compiler ABI info - done -- Check for working C compiler: C:/Program Files/Microsoft Visual Studio/18/Community/VC/Tools/MSVC/14.51.36231/bin/Hostx64/x64/cl.exe - skipped -- Detecting C compile features -- Detecting C compile features - done -- Detecting CXX compiler ABI info -- Detecting CXX compiler ABI info - done -- Check for working CXX compiler: C:/Program Files/Microsoft Visual Studio/18/Community/VC/Tools/MSVC/14.51.36231/bin/Hostx64/x64/cl.exe - skipped -- Detecting CXX compile features -- Detecting CXX compile features - done -- Configuring done (11.1s) -- Generating done (0.1s) -- Build files have been written to: C:/Users/dev/CLionProjects/SuspiciousThreads/build ``` 构建： ``` cmake --build build MSBuild version 18.6.3+84d3e95b4 for .NET Framework 1>Checking Build System Building Custom Rule C:/Users/dev/CLionProjects/SuspiciousThreads/CMakeLists.txt Scanning sources for module dependencies... util.cpp main.cpp Compiling... main.cpp util.cpp SuspiciousThreads.vcxproj -> C:\Users\dev\CLionProjects\SuspiciousThreads\build\Debug\SuspiciousThreads.exe Building Custom Rule C:/Users/dev/CLionProjects/SuspiciousThreads/CMakeLists.txt ``` ## 用法

标签：AMSI绕过, Bash脚本, C++, ETW, Windows, 内存安全, 威胁检测, 安全意识培训, 数据擦除