4.4.8.1

Owned by Noah Greenberg
Last updated: Aug 12, 2024 by Dennis Underwood
1 min read

Features

  • Executable metadata such as product version, company name, etc. for in-memory processes are reported by the driver via kernel visibility. Normal functionality is to use user-space Windows API calls. This move to parsing in the kernel removing the (observed) opportunity for attackers to tamper with the process information.

  • Agent authentication information is replicated elsewhere in the system to restore in the event the registry is corrupted by a malicious driver.

Enhancements

  • Server connection errors are minimally logged by the agent, reducing log size on disk.

Fixes

  • N/A

MD5 Hashes

service.exe = 8c1f6999ccd176193e493686216f14c6 CCRRSecMon.sys (Windows7) = 3b032d0e43674509126c6cb1c9efd688 CCRRSecMon.sys (Windows8) = d3131131c83c2cf833ebc2157149c364 CCRRSecMon.sys (Windows10) = eac8a8b38a8743a13dd7130509de9907

Â