Einayim Implant Analysis

# Detect processes calling GetDesktopWindow + BitBlt frequently
# Sysmon Event ID 10 (ProcessAccess) won't catch this
# Need ETW tracing on GDI32 or behavioral analysis:

# Check for Python processes with GDI handles
Get-Process python*, pythonw* -ErrorAction SilentlyContinue | ForEach-Object {
    $handles = (Get-Process -Id $_.Id).HandleCount
    if ($handles -gt 500) {
        Write-Warning "High handle count: $($_.Name) PID $($_.Id) - $handles handles"
    }
}

# Look for recent screen capture artifacts
Get-ChildItem "$env:TEMP" -Recurse -Include "*.jpg","*.png","*.bmp" -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddMinutes(-30) -and $_.Length -gt 100KB }

# Detect low-level keyboard hooks (SetWindowsHookEx)
# Requires administrative privileges

# Method 1: Check for suspicious Python processes with keyboard hooks
Get-WmiObject Win32_Process -Filter "Name LIKE 'python%'" | ForEach-Object {
    $cmdline = $_.CommandLine
    if ($cmdline -match "pynput|keyboard|hook") {
        Write-Warning "Suspicious Python process: PID $($_.ProcessId) - $cmdline"
    }
}

# Method 2: Sysmon Event ID 1 - look for pynput in command lines
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1} -MaxEvents 1000 |
    Where-Object { $_.Message -match 'pynput|keyboard.*listener' }

# Method 3: Check loaded DLLs for hook indicators
Get-Process python* -ErrorAction SilentlyContinue | ForEach-Object {
    $modules = $_.Modules | Select-Object -ExpandProperty ModuleName
    if ($modules -contains "user32.dll") {
        Write-Output "PID $($_.Id) has user32.dll loaded (potential hook)"
    }
}

# Check which processes have accessed webcam recently
# Windows 10/11 tracks camera access in registry

$camPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam"
Get-ChildItem $camPath -ErrorAction SilentlyContinue | ForEach-Object {
    $lastUsed = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).LastUsedTimeStop
    if ($lastUsed) {
        $app = Split-Path $_.Name -Leaf
        $time = [DateTime]::FromFileTime($lastUsed)
        Write-Output "$app - Last accessed: $time"
    }
}

# Check for Python processes with camera handles
Get-Process python* -ErrorAction SilentlyContinue | ForEach-Object {
    $handles = $_.HandleCount
    Write-Output "Python PID $($_.Id): $handles handles"
}

# Check location service access
$locPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location"
Get-ChildItem $locPath -ErrorAction SilentlyContinue | ForEach-Object {
    $lastUsed = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).LastUsedTimeStop
    if ($lastUsed) {
        $app = Split-Path $_.Name -Leaf
        $time = [DateTime]::FromFileTime($lastUsed)
        Write-Output "Location access: $app at $time"
    }
}

# Monitor for GeoCoordinateWatcher in PowerShell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} -MaxEvents 500 |
    Where-Object { $_.Message -match 'GeoCoordinateWatcher|System\.Device\.Location' } |
    Select-Object TimeCreated, Message

# Check Run keys for suspicious entries
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($key in $runKeys) {
    Get-ItemProperty $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
            $val = $_.Value
            # Flag Python executables, temp paths, or suspicious names
            if ($val -match 'python|\.py|\\Temp\\|AppData\\Local\\Temp') {
                Write-Warning "Suspicious Run entry: $($_.Name) = $val"
            }
        }
    }
}

# Check scheduled tasks
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'python|\.py|powershell.*-enc' -or
    $_.TaskName -match 'Update|Service|Windows' -and $_.Author -notmatch 'Microsoft'
} | Select-Object TaskName, @{N='Command';E={$_.Actions.Execute}}

# Check for version.dll in application directories (should only be in System32)
$legitPath = "$env:SystemRoot\System32\version.dll"

Get-ChildItem "C:\Program Files","C:\Program Files (x86)",$env:APPDATA -Recurse -Filter "version.dll" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        Write-Warning "version.dll found: $($_.FullPath)"
        Write-Warning "  Signed: $($sig.Status) by $($sig.SignerCertificate.Subject)"
    }

# Check DLL search order abuse - application dirs before System32
Get-Process | ForEach-Object {
    $path = $_.Path
    if ($path -and (Test-Path (Join-Path (Split-Path $path) "version.dll"))) {
        Write-Warning "$($_.Name) may load hijacked version.dll from $(Split-Path $path)"
    }
}