Process-BOF

Process-BOF provides commands for inspecting, analyzing, and controlling processes on the compromised system. These commands are essential for pre-injection reconnaissance, identifying sensitive processes, and temporarily controlling security processes.

Compatible agents: Beacon, Gopher | Platform: Windows

findobj#

Searches for specific objects within running processes.

findobj module#

Searches for a loaded module (DLL) across all system processes. Returns a list of processes that have that DLL loaded in their memory space.

findobj module <module_name>

Examples:

# Find processes with .NET loaded (for execute-assembly)
findobj module clr.dll

# Find processes with amsi.dll (AV/EDR)
findobj module amsi.dll

# Find processes with WinHTTP (possible web-connected processes)
findobj module winhttp.dll

Use cases:

• Before using execute-assembly, find processes with clr.dll loaded to inject .NET assemblies into a process that already has the runtime.
• Identify processes loading security modules like amsi.dll or specific EDR DLLs.
• Find injection candidate processes that already have the required dependencies.

findobj prochandle#

Searches which processes hold open handles to a specific process. Useful for identifying security processes monitoring sensitive targets.

findobj prochandle <process_name>

Examples:

# Which processes have handles to LSASS
findobj prochandle lsass.exe

# Which processes monitor csrss.exe
findobj prochandle csrss.exe

# Check if any EDR has a handle to our process
findobj prochandle svchost.exe

Use cases:

• Before attempting credential dumping with hashdump or nanodump, check which security processes are watching LSASS.
• Identify active EDR/AV products maintaining handles to critical processes.
• Assess detection risk before sensitive operations.

process conn#

Shows network connections (TCP/UDP) associated with a specific process.

process conn <pid>

Examples:

# View connections for process PID 4532
process conn 4532

# Check connections of a web service
process conn 1234

Use cases:

• Identify processes making internet connections (possible communication channels).
• Verify that a bind TCP listener is listening on the correct port.
• Analyze network traffic of a suspicious process during investigation.
• Find processes with established connections that could provide cover for agent traffic.

procfreeze#

Suspend and resume entire processes. Freezes or unfreezes all threads of a process.

procfreeze freeze#

Suspends all threads of a target process.

procfreeze freeze <pid>

procfreeze unfreeze#

Resumes all threads of a previously suspended process.

procfreeze unfreeze <pid>

Examples:

# Temporarily freeze an AV process
procfreeze freeze 2844

# Perform sensitive operations...
hashdump

# Unfreeze the process
procfreeze unfreeze 2844

Use cases:

• Temporarily suspend EDR/AV processes before executing operations that would be detected (credential dumping, injection).
• Pause a process to analyze its state without it modifying files or connections.
• Freeze monitoring processes during short operation windows.

Warning: A security process frozen for too long may trigger alerts in the EDR/AV management console, as it will stop sending heartbeats. Only use this technique during brief operations.

Recommended workflow#

1. Use findobj module to identify candidate processes for injection.
2. Use findobj prochandle to verify which security processes are monitoring your targets.
3. If necessary, use procfreeze freeze to temporarily suspend security processes.
4. Perform your operations (injection, credential dumping, etc.).
5. Use procfreeze unfreeze to restore suspended processes.
6. Use process conn to verify the network connections of the injected agent.