admin/ghost
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add Windows hook injection detection (SetWindowsHookEx)

Browse Source
This commit is contained in:
Adir Shitrit
2025-11-08 11:13:14 +02:00
parent 47c58f6b50
commit c65d24cd16
4 changed files with 187 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ghost-core/src/detection.rs
View File

@@ -1,4 +1,4 @@
use crate::{MemoryProtection, MemoryRegion, ProcessInfo, ThreadInfo};
use crate::{detect_hook_injection, MemoryProtection, MemoryRegion, ProcessInfo, ThreadInfo};
use std::collections::HashMap;
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -94,6 +94,22 @@ impl DetectionEngine {
if let Some(thread_list) = threads {
self.analyze_threads(thread_list, &mut indicators, &mut confidence);
}
// Check for Windows hook injection
if let Ok(hook_result) = detect_hook_injection(process.pid) {
if hook_result.suspicious_count > 0 {
indicators.push(format!(
"{} suspicious Windows hooks detected",
hook_result.suspicious_count
));
confidence += 0.6; // High confidence for hook-based injection
}
if hook_result.global_hooks > 8 {
indicators.push("Excessive global hooks (possible system compromise)".to_string());
confidence += 0.3;
}
}
self.baseline.insert(
process.pid,