Monitors network activity made by a process through the use of Windows Event Tracing (ETW) and Full Packet Capture (FPC). Filters a generated .pcap file with BPF based on the detected network activity made by the process. This application makes process network monitoring hella' easy.

• Can start and monitor an executable.
• Can monitor an already running process.
• Can monitor additional related processes based on executable names.
• Executables can be run as other users and in elevated and unelevated states.
• Creates a full packet capture .pcap file per process.
• Records TCPIP activities made by a processes, netflow style.
• Records DNS requests and responses made and retrieved by applications.
• Creates Wireshark filter for domains queried via DNS with the DNS responses
• Can specify pcap filtering to only record TCPIP activity being sent from the process. This is applied to the recorded .pcap.
• Can be automated with a timer.
• By default all monitoring is applied to all spawned child processes.
• Can kill spawned process and its childprocesses on stop.
• Process and DNS results can be exported to JSON.
• Can generate a Wireshark DFL filter per process.
• Can generate a BPF filter per process.

(Must be run as administrator - for packet capture and listening to ETW)

Get a list of available interfaces to monitor:

WhoYouCalling.exe --getinterfaces
[*] Available interfaces:
 0) WAN Miniport (Network Monitor)
 1) WAN Miniport (IPv6)
...
 8) Realtek USB GbE Family Controller
        IPv4: 192.168.1.10
        IPv6: fd12:3456:789a:1::2
 9) Adapter for loopback traffic capture
        IPv6: ::1
        IPv4: 127.0.0.1

Execute a binary with arguments. Output the results to a folder on the user desktop:

WhoYouCalling.exe -e C:\Users\H4NM\Desktop\TestApplication.exe -a "--pass=ETph0n3H0m3" -i 4 -o C:\Users\H4NM\Desktop

Listen to process with PID 1337 and output the results to json. Skip packet capture:

WhoYouCalling.exe --pid 1337 --nopcap --json --output C:\Users\H4NM\AppData\Local\Temp

Run sus.exe for 60 seconds with FPC on the 8th interface. When the timer expires, kill tracked processes - including child processes:

WhoYouCalling.exe -e C:\Users\H4NM\Desktop\sus.exe -t 60 -k -i 8 -o C:\Users\H4NM\Desktop

Execute firefox.exe and also monitor for other processes with the same executable name (This is especially needed if the main processes calls an already running process like explorer.exe to start a child process.)

WhoYouCalling.exe --executable "C:\Program Files\Mozilla Firefox\firefox.exe" --nopcap --execnames "firefox.exe"

There are other tools that can compliment your quest of application network analysis:

• Frida: Provides the most granular interaction with applications in which you can view API calls made.
  • "It lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX."
• Deluder and PETEP (PEnetration TEsting Proxy): Deluder uses frida but acts as an interface towards capturing the network traffic made by the application, similar to WhoYoucalling. Deluder also allows for many other fun things, including integration with the PETEP proxy for viewing and editing packets live.
• Windows Sandbox: A simple and native sandbox in Windows. I strongly recommend using a sandbox or VM when when executing unknown applications. There's also the possibility of adding your own configuration for the Windows Sandbox to harden it a bit further or include WhoYouCalling with the sandbox on start. See more here

• DNS: In ETW, Microsoft-Windows-DNS-Client only logs A and AAAA queries, neglecting other DNS query types such as PTR, TXT, MX, SOA etc. It does capture CNAME and it's respective adresses, which are part of the DNS response. However, with the FPC the requests are captured either way, just not portrayed as in registered DNS traffic by the application.
• Execution integrity: It's currently not possible to delegate the privilege of executing applications in an elevated state to other users, meaning that if you want to run the application elevated you need to be signed in as the user with administrator rights.
  Since WhoYouCalling requires elevated privileges to run (ETW FPC), spawned processes naturally inherits the security token making them also posess the same integrity level - and .NET api does not work too well with creating less privileged processes from an already elevated state. The best and most reliable approach was to duplicate the low privileged token of the desktop shell in an interactive logon (explorer.exe). However, there may be use cases in which WhoYouCalling is executed via a remote management tool like PowerShell, SSH or PsExec, where there is no instance of a desktop shell, in these case you need to provide a username and password of a user that may execute it.

This project has been tested and works with .NET 8 with two nuget packages, and drivers for capturing network packets:

• FPC:
  • SharpCap
  • npcap
• ETW: Microsoft.Diagnostics.Tracing.TraceEvent

npcap is optional when running WhoYouCalling if packet capture is not needed

Follow these steps for compiling from source:

1. Make sure .NET 8 is installed

2. Download and install npcap. It enables packet capture in Windows. It's not needed if the flag for not capturing packets is provided.

3. Download this repo

git clone https://github.com/H4NM/WhoYouCalling.git

4. Enter project

cd WhoYouCalling

5. Install the related packages (SharpCap and TraceEvent).

dotnet restore

6. Build

dotnet publish -c Release -r win-(x64 or x86) --self-contained true

7. Run

bin\Release\net8.0\win-x64\WhoYouCalling.exe [arguments]...

• Refactor. Lots and lots to refactor and make more tidy :)

• Network graph visualizing the process tree and summarized network traffic by each process
• Functionality to not specify an executable nor pid, to monitor all running processes and their network activity on a host. Could be useful during incidents