bof_process
Enumerate processes for loaded modules, handles, and TCP connections. Freeze target processes using PPL bypass, then unfreeze them.
Instructions
Process-BOF: Process enumeration and manipulation.
findobj module List all processes that have a specific module loaded. Example: findobj module clr.dll
findobj prochandle List all processes that have a handle to the specified process. Example: findobj prochandle lsass.exe
process conn List processes with established TCP/RDP connections with detailed info. Example: process conn
procfreeze freeze Freeze a target process using PPL bypass via WerFaultSecure.exe. Example: procfreeze freeze 1234
procfreeze unfreeze Unfreeze a previously frozen process. Example: procfreeze unfreeze
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| command | Yes | ||
| args | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |