1

Is there any way to prevent meterpreter process migration.?

closed as unclear what you're asking by Serge Ballesta, Steffen Ullrich, Sjoerd, Stephane, Julian Knight May 29 '17 at 20:17

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Are you talking about the endpoint that has been compromised? – ISMSDEV May 27 '17 at 7:28
  • Yes....Like the attacker has already got the shell or else he somehow get access to open(unlocked) unattended machine... – Mashhoor Gulati May 28 '17 at 19:47
0

Based on this question, process migration requires the SeDebugPrivilege to create a thread attached to a remote process, so denying it should block the migration process. Sadly, there is no clear definition on how to do it, but seems like this privilege is part of the user / group privileges so using a non-admin user without this privilege should block process migration.

Also any advanced AV-System should be able to detect and block process migration, but I only tested it on Kaspersky which did block mirgration.

  • In my case Kaspersky could not block.!! Though have not checked with any other yet. – Mashhoor Gulati May 28 '17 at 19:49
  • I've tuned my Kaspersky settings to do extensive behavior analytics, maybe that's required to block migration. – VincBreaker May 28 '17 at 19:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.