Callback Enumeration
Enumerate registered kernel callbacks to identify EDR/AV hooks and security product registrations.
Callback Types
Process Callbacks
PsSetCreateProcessNotifyRoutineExRegistered by AV/EDR to monitor process creation and termination.
Thread Callbacks
PsSetCreateThreadNotifyRoutineMonitor thread creation across all processes.
Image Load Callbacks
PsSetLoadImageNotifyRoutineMonitor DLL/EXE loading — commonly used for injection detection.
Object Callbacks
ObRegisterCallbacksMonitor handle operations (create/duplicate) for process and thread handles. Shows pre/post operation callbacks, altitude, and monitored operations.
Registry Callbacks
CmRegisterCallbackExMonitor registry operations (create, open, set, delete, rename, query).
Callback Information
For each callback, the driver returns:
- • Index — Callback slot index (0-63)
- • Callback Address — Kernel address of the callback function
- • Module Name — Driver that registered the callback (e.g., WdFilter.sys)
- • Module Base — Base address of the owning module
- • Offset — RVA within the module
Object Callback Details
Object callbacks provide additional information:
- • Altitude — Callback priority (higher = called first)
- • Pre-Operation Callback — Called before handle operation
- • Post-Operation Callback — Called after handle operation
- • Object Type — Process or Thread
- • Operations — Handle Create, Handle Duplicate, or both
Callback Removal
Callbacks can be removed or restored via context menu:
- • Remove Callback — Unregister the callback (zeros the slot)
- • Restore Callback — Re-register a previously removed callback
Usage
- Navigate to Kernel Enumeration tab
- Select Callback Enumeration sub-tab
- Click callback type buttons (Process, Thread, Image, Object, Registry)
- Use search filter to find specific modules or addresses
- Right-click for context menu actions
Common EDR/AV Modules
WdFilter.sys (Windows Defender)SentinelMonitor.sysCarbonBlackK.sysesensor.sys (ESET)mfeaskm.sys (McAfee)symefasi.sys (Symantec)CyOptics.sys (Cylance)csagent.sys (CrowdStrike)
IOCTLs
| IOCTL | Code |
|---|---|
| ENUM_PROCESS_CALLBACKS | 0x809 |
| ENUM_THREAD_CALLBACKS | 0x80A |
| ENUM_IMAGE_CALLBACKS | 0x80B |
| ENUM_OBJECT_CALLBACKS | 0x810 |
| ENUM_REGISTRY_CALLBACKS | 0x81E |