Nidhogg v0.4 releases: multi-functional rootkit for red teams

Nidhogg

Nidhogg is a multi-functional rootkit for red teams. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for red team engagements that can be integrated with your C2 framework via a single header file with simple usage, you can see an example here.

Nidhogg can work on any version of x64 Windows 10 and Windows 11.

This repository contains a kernel driver with a C++ header to communicate with it.

Current Features

• Process hiding and unhiding
• Process elevation
• Process protection (anti-kill and dumping)
• Bypass pe-sieve
• Thread hiding
• Thread protection (anti-kill)
• File protection (anti-deletion and overwriting)
• File hiding
• Registry keys and values protection (anti-deletion and overwriting)
• Registry keys and values hiding
• Querying currently protected processes, threads, files, registry keys and values
• Arbitrary kernel R/W
• Function patching
• Built-in AMSI bypass
• Built-in ETW patch
• Process signature (PP/PPL) modification
• Can be reflectively loaded

Reflective loading

Since version v0.3, Nidhogg can be reflectively loaded with kdmapper but because PatchGuard will be automatically triggered if the driver registers callbacks, Nidhogg will not register any callback. Meaning, that if you are loading the driver reflectively these features will be disabled by default:

• Process protection
• Thread protection
• Registry operations

PatchGuard triggering features

These are the features known to me that will trigger PatchGuard, you can still use them at your own risk.

• Process hiding
• Thread hiding
• File protecting

Changelog v0.4

New features:

• DLL Injection
  • Via APC
  • Via NtCreateThread
• Shellcode Injection
  • Via APC
  • Via NtCreateThread
• Unregistering and restoring callbacks
  • ObCallbacks
  • PsSetCreateProcessNotifyRoutine
  • PsSetCreateThreadNotifyRoutine
  • Image Load
  • Registry callbacks
• ETWTI tampering (disable and enable)

Improvements

• Fixed kdmapper compatibility issues
• Added validation for SSDT function getting
• Added length check to registry objects
• Increased overall stability

Misc

• Created CMake to compile the client
• Made driver code more efficient

Download & Use

Copyright (c) 2022, Ido Veltzman
All rights reserved.