RegistryMonitor.cpp

#include "RegistryMonitor.h"
#include "ThreatEnricher.h"
#include "../utils/FileUtils.h"

#include <Shlwapi.h>
#include <Windows.h>

#pragma comment(lib, "shlwapi.lib")

namespace dl2 {

namespace {

struct HijackRule {
    const wchar_t* name;
    const wchar_t* keyPath;
    const wchar_t* triggerExe;
    const wchar_t* technique;
};

const HijackRule kRules[] = {
    { L"mscfile", L"Software\\Classes\\mscfile\\shell\\open\\command",
      L"eventvwr.exe", L"EventVwr mscfile hijack" },
    { L"ms-settings", L"Software\\Classes\\ms-settings\\shell\\open\\command",
      L"fodhelper.exe", L"fodhelper ms-settings hijack" },
    { L"exefile", L"Software\\Classes\\exefile\\shell\\open\\command",
      nullptr, L"exefile handler hijack" },
    { L"mscfile (HKLM)", L"Software\\Classes\\mscfile\\shell\\open\\command",
      L"eventvwr.exe", L"HKLM mscfile hijack" },
};

bool pathUnderWindows(const std::wstring& path) {
    const std::wstring norm = FileUtils::normalizePath(path);
    return norm.find(L"c:\\windows\\") == 0;
}

std::wstring readDefaultValue(HKEY root, const std::wstring& subKey) {
    HKEY key = nullptr;
    if (RegOpenKeyExW(root, subKey.c_str(), 0, KEY_READ, &key) != ERROR_SUCCESS) {
        return L"";
    }

    DWORD type = 0;
    DWORD size = 0;
    if (RegQueryValueExW(key, nullptr, nullptr, &type, nullptr, &size) != ERROR_SUCCESS ||
        type != REG_SZ || size < sizeof(wchar_t)) {
        RegCloseKey(key);
        return L"";
    }

    std::vector<wchar_t> buffer(size / sizeof(wchar_t) + 1, L'\0');
    if (RegQueryValueExW(key, nullptr, nullptr, &type,
                         reinterpret_cast<LPBYTE>(buffer.data()), &size) != ERROR_SUCCESS) {
        RegCloseKey(key);
        return L"";
    }
    RegCloseKey(key);
    return buffer.data();
}

bool isSuspiciousHandler(const std::wstring& value) {
    if (value.empty()) {
        return false;
    }

    const std::wstring norm = FileUtils::normalizePath(value);
    if (norm.find(L"system32\\eventvwr.exe") != std::wstring::npos ||
        norm.find(L"system32\\fodhelper.exe") != std::wstring::npos ||
        norm.find(L"system32\\computerdefaults.exe") != std::wstring::npos ||
        norm.find(L"system32\\sdclt.exe") != std::wstring::npos) {
        return false;
    }

    if (pathUnderWindows(value) && norm.find(L"\\windows\\system32\\") != std::wstring::npos) {
        return false;
    }

    if (norm.find(L"mmc.exe") != std::wstring::npos && norm.find(L"%systemroot%") != std::wstring::npos) {
        return false;
    }

    return norm.find(L".exe") != std::wstring::npos ||
           norm.find(L"powershell") != std::wstring::npos ||
           norm.find(L"cmd.exe") != std::wstring::npos ||
           norm.find(L"\\appdata\\") != std::wstring::npos ||
           norm.find(L"\\temp\\") != std::wstring::npos ||
           norm.find(L"\\users\\") != std::wstring::npos;
}

std::vector<DetectionAlert> checkRule(const HijackRule& rule,
                                      std::unordered_set<std::wstring>& reported) {
    std::vector<DetectionAlert> alerts;

    const HKEY roots[] = { HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE };
    for (HKEY root : roots) {
        if (wcscmp(rule.name, L"mscfile (HKLM)") == 0 && root != HKEY_LOCAL_MACHINE) {
            continue;
        }
        if (wcscmp(rule.name, L"mscfile (HKLM)") != 0 && root == HKEY_LOCAL_MACHINE &&
            wcscmp(rule.keyPath, L"Software\\Classes\\mscfile\\shell\\open\\command") == 0) {
            continue;
        }

        const std::wstring value = readDefaultValue(root, rule.keyPath);
        if (!isSuspiciousHandler(value)) {
            continue;
        }

        const std::wstring hive = (root == HKEY_CURRENT_USER) ? L"HKCU" : L"HKLM";
        const std::wstring key = rule.keyPath;
        const std::wstring dedup = hive + L"|" + key + L"|" + FileUtils::normalizePath(value);
        if (reported.count(dedup) > 0) {
            continue;
        }
        reported.insert(dedup);

        DetectionAlert alert{};
        alert.timestamp = FileUtils::iso8601Now();
        alert.severity = L"HIGH";
        alert.anomalyScore = 98;
        alert.pid = 0;
        alert.process = rule.triggerExe ? rule.triggerExe : L"Registry";
        alert.processPath = hive + L"\\" + key;
        alert.dllName = rule.name;
        alert.suspiciousDll = value;
        alert.detectionMethod = L"Registry";
        alert.loadState = L"HIJACKED";
        alert.injectionRisk = L"UAC Bypass Registry";
        alert.processOrigin = L"User / System";
        alert.pathWriteAccess = L"HKCU writable without admin";
        alert.recommendation = L"Remove hijacked file association - " + std::wstring(rule.technique);
        alert.alertKey = dedup;
        alert.details =
            L"Technique: " + std::wstring(rule.technique) +
            L"\r\nRegistry: " + hive + L"\\" + key +
            L"\r\nHandler: " + value;
        if (rule.triggerExe) {
            alert.details += L"\r\nTrigger: " + std::wstring(rule.triggerExe) + L" (autoElevate)";
        }

        ThreatEnricher::enrich(alert);
        alerts.push_back(alert);
    }

    return alerts;
}

} // namespace

void RegistryMonitor::resetReported() {
    reported_.clear();
}

std::vector<DetectionAlert> RegistryMonitor::scan() {
    std::vector<DetectionAlert> all;
    for (const auto& rule : kRules) {
        auto found = checkRule(rule, reported_);
        all.insert(all.end(), found.begin(), found.end());
    }

    if (GetFileAttributesW(L"C:\\Windows \\") != INVALID_FILE_ATTRIBUTES ||
        GetFileAttributesW(L"C:\\Windows \\System32") != INVALID_FILE_ATTRIBUTES) {
        const std::wstring dedup = L"fake-trusted-dir";
        if (reported_.count(dedup) == 0) {
            reported_.insert(dedup);

            DetectionAlert alert{};
            alert.timestamp = FileUtils::iso8601Now();
            alert.severity = L"HIGH";
            alert.anomalyScore = 99;
            alert.process = L"Filesystem";
            alert.processPath = L"C:\\Windows \\";
            alert.dllName = L"(directory)";
            alert.suspiciousDll = L"C:\\Windows \\System32";
            alert.detectionMethod = L"TrustedDir";
            alert.loadState = L"PRESENT";
            alert.injectionRisk = L"Fake Trusted Directory";
            alert.pathWriteAccess = L"Attacker-controlled path";
            alert.recommendation =
                L"Remove C:\\Windows \\ fake trusted directory (UAC bypass staging)";
            alert.alertKey = dedup;
            alert.details =
                L"Fake trusted directory exists on disk.\r\n"
                L"Used by DLLHijackingScanner trusted-directory UAC bypass.";
            ThreatEnricher::enrich(alert);
            all.push_back(alert);
        }
    }

    return all;
}

} // namespace dl2