Lab 02 — AMSI/ETW Residual-Visibility Mapper

Lens: the sensor map / residual detection. WARMUP: Chapters 3–6.

The problem

The most dangerous belief on both sides of EDR is "I evaded the EDR." No one evades "the EDR" — you blind a specific sensor. The whole detection-engineering insight of Phase 07 is that the EDR is not one eye; it is a stack of sensors at different trust boundaries, and an evasion that lives in the attacker's own user-mode process can only blind the sensors that process can reach. Patch ntdll's hooks, patch EtwEventWrite, bypass AMSI — all of that happens in ring 3. The kernel notify routines (PsSetCreateProcessNotifyRoutine, image/thread callbacks) and the kernel-emitted ETW-TI provider fire from ring 0 and never see the patch. So the injected payload that "evaded the EDR" is still in the kernel callback's logbook. And the act of evading — the AMSI bypass, the ETW patch, the ntdll unhook — is itself a detection.

This lab makes that concrete. A technique's behavior is the set of sensors that would observe it on a fully-instrumented host. You apply evasions, each of which blinds specific (user-mode) sensors, and compute what visibility remains, whether it is still detectable, and the residual detection.

Safety. Authorized-education only. This models which sensor each evasion blinds and which survive over synthetic metadata. There is no working bypass, no patch routine, and no unhooking code anywhere in this lab.

The lesson encoded

                    behavior (fully instrumented)
   user-mode:  ntdll_hook   amsi   etw_dotnet   script_block     <- attacker can reach & blind these
   kernel:     kernel_callbacks   etw_ti   minifilter   network  <- ring 0; survive user-mode evasion

   apply { unhooked_ntdll, amsi_bypassed, etw_patched } -> blinds the user-mode row ONLY
   residual = { kernel_callbacks, etw_ti, ... }  -> STILL DETECTABLE
   AND each evasion is itself observable -> a residual detection even if every sensor is blinded

What you build (`lab.py`)

residual_visibility(behavior, evasions) — {behavior, original, blinded, residual, residual_kernel, residual_user}. The kernel/user split is the lesson made executable.
still_detectable(behavior, evasions) — True if any sensor survives or any applied evasion is itself detectable.
residual_detection(behavior, evasions) — {detectable, via_sensors, sensor_detections, evasion_detections, summary}. via_sensors lists kernel sensors first (the durable detection), and evasion_detections gives the detection of each evasion itself.

Attack → detection cases the tests cover

Core invariant: no modeled evasion blinds a kernel sensor (asserted directly over EVASIONS).
An ETW patch blinds the user-mode CLR ETW provider, but the kernel callback and ETW-TI survive — the behavior is still detectable.
An unhooked ntdll blinds the user-mode hook, but the kernel callback still sees the injection.
An AMSI bypass on a script-only behavior blinds every observing sensor — yet the behavior is still detectable because the AMSI bypass is itself observable.
The full user-mode evasion set vs a kernel-observed behavior leaves the kernel residual intact; partial ⊇ full residual; unknown evasions blind nothing; output is deterministic.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q     # reference passes (12 tests)
pytest -q                          # your implementation after the TODOs
# fallback interpreter:
LAB_MODULE=solution /Users/s0x/src/10xdev/ai-enigneer/.venv/bin/python -m pytest -q

Hardening / detection extensions

Encode the specific residual Sigma logic for each surviving sensor (e.g. ETW-TI RWX on a system DLL, image-load of a second clean ntdll, AMSI-bypass test-string signature) and emit it as a rule stub.
Model EDR variation: different products hook different functions and emit different ETW-TI signals; parameterize which sensor each evasion actually blinds per product.
Feed the residual set back into Lab 01: a technique that Lab 01 calls "detectable" may be brittle if its only surviving sensor is one a common evasion blinds — flag it.
Add call-stack telemetry as a first-class sensor and model how indirect syscalls still leave a return-address anomaly.

Multi-language extension (own range)

On the owned range, stand up Sysmon + an ETW-TI consumer (SilkETW/SealighterTI) and write a small C# or Rust ETW consumer that records which providers fire for a benign Atomic test — then compare the real residual to this model's prediction. (Consume telemetry only; never ship a bypass.)

Interview / resume

"Built an AMSI/ETW residual-visibility mapper that, given a technique's sensor footprint and a set of evasions, computes which sensors remain, proves user-mode evasions never blind kernel sensors, and emits the residual detection — including the detection of the evasion itself when every observing sensor is blinded."

Limitations: a representative slice of evasions and sensors; each evasion blinds a fixed sensor set (real evasions vary by implementation and EDR product); "still detectable" means a surviving sensor or detectable evasion exists, not that a tuned rule fires noise-free; the residual detections are illustrative Sigma-style intent, not validated rules.

Red Team Engineer