Nidhogg – All-In-One Simple To Use Rootkit For Red Teams

Nidhogg is a multi-functional rootkit for red teams. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for red team engagements that can be integrated with your C2 framework via a single header file with simple usage, you can see an example here.

Nidhogg can work on any version of x64 Windows 10 and Windows 11.

This repository contains a kernel driver with a C++ header to communicate with it.

Current Features

• Process hiding and unhiding
• Process elevation
• Process protection (anti-kill and dumping)
• Bypass pe-sieve
• Thread hiding
• Thread protection (anti-kill)
• File protection (anti-deletion and overwriting)
• File hiding
• Registry keys and values protection (anti-deletion and overwriting)
• Registry keys and values hiding
• Querying currently protected processes, threads, files, registry keys and values
• Arbitrary kernel R/W
• Function patching
• Built-in AMSI bypass
• Built-in ETW patch
• Process signature (PP/PPL) modification
• Can be reflectively loaded
• Shellcode Injection
  • APC
  • NtCreateThreadEx
• DLL Injection
  • APC
  • NtCreateThreadEx
• Querying kernel callbacks
  • ObCallbacks
  • Process and thread creation routines
  • Image loading routines
  • Registry callbacks
• Removing and restoring kernel callbacks
• ETWTI tampering

Reflective loading

Since version v0.3, Nidhogg can be reflectively loaded with kdmapper but because PatchGuard will be automatically triggered if the driver registers callbacks, Nidhogg will not register any callback. Meaning, that if you are loading the driver reflectively these features will be disabled by default:

• Process protection
• Thread protection
• Registry operations

PatchGuard triggering features

These are the features known to me that will trigger PatchGuard, you can still use them at your own risk.

• Process hiding
• File protecting

Basic Usage

It has a very simple usage, just include the header and get started!

#include "Nidhogg.hpp"

int main() {
    HANDLE hNidhogg = CreateFile(DRIVER_NAME, GENERIC_WRITE | GENERIC_READ, 0, nullptr, OPEN_EXISTING, 0, nullptr);
    // ...
    DWORD result = Nidhogg::ProcessUtils::NidhoggProcessProtect(pids);
    // ...
}

Setup

Building the client

To compile the client, you will need to install CMake and Visual Studio 2022 installed and then just run:

bcdedit /set testsigning on

sc create nidhogg type= kernel binPath= C:\Path\To\Driver\Nidhogg.sys
sc start nidhogg

bcdedit /debug on

Original Source

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

 To keep up to date follow us on the below channels.