STR took two tools to Black Hat Arsenal this year: Obscurize, a defensive deception tool that turns malware’s own anti-analysis checks against it, and Inquisitron, a real-time Sysmon viewer and behavioral detection engine for threat hunting. Obscurize was demoed twice across the Arsenal schedule, and both sessions drew a standing crowd well past the session ending.
The reception said as much as the attendance numbers. Several attendees told us they had been looking for something like Obscurize for a very long time, and one even asked for selfies “with the developer” during the demo. Both projects are open source and available now on Github. Links below!
I personally never thought I would get to the point where I would have something unique and novel enough to bring to a conference like Black Hat, but here I am! This journey took me through learning the inner workings of Windows subsystems, how Detours work, userland rootkits and how they can be used offensively and defensively. We all learn from various sources, even from those we defend against. Asking the question, “how can we use this for good” comes up a lot when the STR team breaks apart a malware sample. It also inspires us to create things that make our lives easier — we are always looking to innovate and iterate on something cool! Obscurize and Inquisitron are the result of many of those innovation questions being asked, brainstorming sessions and handfuls of malware samples analyzed.
|
|
Obscurize — Malware for Defense and Counter-Offense
Modern malware checks its environment before it does anything interesting. Obscurize is a defensive deception tool that uses userland API hooking to manipulate what a running process perceives about the host, and it works in two directions:
Defensive Mode makes a real production host look like a sandboxed VM — VMware BIOS strings, 2 GB of RAM, an analysis-style username, an 800x600 display, a VMware MAC OUI — so malware performing anti-analysis checks self-terminates before executing its payload.
Trap Mode does the opposite: it strips VM indicators from a honeypot and presents a real-hardware profile (Dell BIOS, 16 GB RAM, corporate firstname.lastname identity, Intel MAC OUI) so malware passes its checks and executes fully, under observation.
| 
|
What it covers
| Hooking | Up to 26 Microsoft Detours hooks on Win32 and NT APIs, injected reflectively into every user process. No kernel driver, no system file changes. |
| Surface | Username, computer name, RAM, resolution, MAC OUI, BIOS registry and raw SMBIOS, service and process enumeration, registry enumeration, domain-join state. |
| Tooling | Covers what the attacker actually runs: systeminfo.exe and wmic.exe stdout are patched, whoami resolves to the spoofed identity, and -NoProfile is stripped from PowerShell spawns so the WMI hook always loads. |
| Domain gate | A separate Off / Workgroup / Joined selector spoofs Win32_ComputerSystem.PartOfDomain, built in response to FAUX#ELEVATE gating its payload on domain membership. |
| Reversible | On service stop every agent detaches, artifact keys and decoy files are removed, and the PowerShell profile is restored from backup. |
The threat model comes straight out of our own casework: DEAD#VAX checks username, RAM, MAC OUI, WMI BIOS strings and VM registry keys before proceeding, and FAUX#ELEVATE withholds its full payload chain from anything that is not domain-joined. Obscurize answers both.
github.com/fluffybunnies-h4x/Obscurize
Inquisitron — Real-Time Sysmon Hunting
Sysmon produces excellent telemetry and Event Viewer is a terrible place to read it: slow to load, no live streaming, no process lineage, no way to pivot from an event to the rest of its story. Inquisitron replaces it — a push-based EventLogWatcher subscription rather than polling, so events appear the instant Sysmon writes them, batched into the grid four times a second.
Multi-channel correlation. Several logs stream into one merged, time-ordered timeline — Sysmon process lineage beside PowerShell script blocks, Security logons and System service installs (7045 lands on System, which Sysmon never sees). Event IDs resolve per channel, so Sysmon 7 stays “Image Loaded” while System 7 does not borrow that meaning.
A behavioral detection engine. Every event is scored on arrival against a JSON rule set, colored by severity and explained in plain language. Reload the rule file and every loaded event re-scores in place — edit, save, reload is the tuning loop. The shipped packs are derived from published Securonix advisories, including SMOKE#SCREEN and FAUX#ELEVATE.
Built for pivoting. Process-tree reconstruction keyed by ProcessGuid so PID reuse cannot corrupt the tree, per-column filters with exclusion syntax, right-click pivots on PID / PPID / process / event ID, and CSV or JSON export of whatever is currently visible. Saved .evtx files get the same parsing, scoring and tree reconstruction as a live capture.
No network egress, by design. It reads local event logs and writes local files. No telemetry, no cloud, no update checks — the tool is pointed at telemetry from potentially compromised hosts, and that data never leaves the analyst’s machine.
github.com/fluffybunnies-h4x/Inquisitron
TBW Advisors LLC
Another opportunity that came my way during Black Hat was an interview with Dr. Doreen Galli from TBW Advisors. Dr. Doreen Galli is a former Microsoft Azure CTO, IBM Master Inventor, and holder of 9 U.S. patents — with practitioner contributions across cloud, data, security, healthcare, finance, logistics, manufacturing, and more. Their Youtube channel carries three series: Conference Whispers — live event coverage from the floors. Whisper Reports — question-driven analysis, direct quotes, real takeaways. Industry Whispers — feature-length documentary conversations. The interview hit the ground running reviewing questions I was able to choose to address giving my specific industry take along with some of my quick thoughts on STR and Obscurize.
Intro to what I think is unique about STR
Quick run down of Obscurize