matterpreter / matterpreter/DefenderCheck

File splitting misses final bytes of file resulting in false negatives

Open
#21 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

good first issue
Dominant language
C#
Stars
2.6k
Forks
482
PR merge metrics
No merged PRs in 30d

Description

The file split method appears to miss the final bytes of the file resulting in false negatives.

Scanning the original file from the command line give the following output :

```
"c:\Program Files\Windows Defender\MpCmdRun.exe" -scan -scantype 3 -file "c:\users\test\desktop\file.exe" -DisableRemediation
Scan starting...
Scan finished.
Scanning c:\users\test\desktop\file.exe found 1 threats.

<===========================LIST OF DETECTED THREATS==========================>
----------------------------- Threat information ------------------------------
Threat : EUS:Win32/CustomEnterpriseBlock
Resources : 1 total
file : c:\users\test\desktop\file.exe
-------------------------------------------------------------------------------
```

Using DefenderCheck the output is as follows:
```

C:\Users\test\Desktop>DefenderCheck.exe file.exe
Target file size: 271872 bytes
Analyzing...

Exhausted the search. The binary looks good to go!
```

However the testfile.exe in c:\temp\ and original file are different sizes (tempfile.exe is two bytes shorter).

```
C:\Users\test\Desktop>dir
Volume in drive C has no label.
Volume Serial Number is 22ED-CC37

Directory of C:\Users\test\Desktop

12/23/2021 10:15 AM .
12/23/2021 10:15 AM ..
12/22/2021 03:50 PM 271,872 file.exe
```

Directory of c:\temp

```
12/23/2021 10:07 AM .
12/23/2021 10:07 AM ..
12/23/2021 10:26 AM 271,870 testfile.exe
1 File(s) 271,870 bytes
2 Dir(s) 40,053,174,272 bytes free

```
Manually scanning the file in the temp directory gives a clean result

```
"c:\Program Files\Windows Defender\MpCmdRun.exe" -scan -scantype 3 -file "c:\temp\testfile.exe" -DisableRemediation
Scan starting...
Scan finished.
Scanning c:\temp\testfile.exe found no threats.
```

Edit to add :

Possibly just a clarification in the 'Good to go' output? Show the initial detection and why analysis started?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is named. Reproduce the report with the original file and the generated temporary file, then trace the file-splitting path and compare their sizes and final bytes; done means the behavior is understood and the reported false negative or output clarification is addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.