participated in project for immunity called el jefewhich is at its core very simple processmonitoring system with centralized logging(be used by people on the defense side of security to track process creation and the installation of malware while consulting one daymy coworker mark wuergler suggested that we use el jefe as lightweight mechanism to monitor processes executed as system on our target windows machines this would give us insight into potentially insecure file handling or child process creation it workedand we walked away with numerous privilege escalation bugs that gave us the keys to the kingdom the major drawback of the original el jefe is that it used dll that was injected into every process to intercept calls to all forms of the native createprocess function it then used named pipe to communicate to the collection clientwhich then forwarded the details of the process creation to the logging server the problem with this is that most antivirus software also hooks the createprocess callsso either they view you as malware or you have system instability issues when el jefe runs side-by-side with antivirus software we'll re-create some of el jefe' monitoring capabilities in hookless mannerwhich also will be geared toward offensive techniques rather than monitoring this should make our monitoring portable and give us the ability to run with antivirus software activated without issue