WHIDS Update

The talk gives an update on a self-built endpoint detection and response project with two parts: an agent on each endpoint that reads Sysmon logs and applies custom detection rules in real time, and a manager that exposes APIs for administrators and for the agents. The speaker first recaps the core capabilities. When an alert fires, the agent can capture process memory, registry changes or a structured JSON report within seconds, and it can kill or blacklist processes. The manager handles endpoints, logs, stored artifacts and aggregated detection reports that help rank machines for triage. Events can also be streamed over a websocket to plugins, with MISP integrations as examples.

The main part covers what changed over the past year. Response actions can now be set per rule instead of only by alert criticality. Sysmon and OSQuery deployment and configuration, previously done by hand on each machine, can be pushed from the manager, and the agent configuration is centralized the same way. Indicator handling was decoupled from MISP through a generic API, so any data source can feed it. On Windows, the agent moved from hooking the older event log API to consuming ETW, which the speaker presents as faster, more flexible and less exposed to a known evasion. API documentation is now generated from tests through a git hook, and a CI/CD pipeline was built.

The talk closes with next steps: finishing a long-delayed release, publishing real attack and malware case studies, and eventually porting to Linux and macOS, where the speaker says no framework matches Sysmon's telemetry. In the Q&A, API hooking was rejected as intrusive and easy for malware to bypass in user mode. The speaker invited feedback, feature requests, code contributions and sponsorship.