Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
4.3 Process Gremlin
The Process Gremlin has the capability to subvert the execution of existing or
started processes in a few annoying ways by either temporarily delaying the
execution of a process, killing an existing process, or “locking up” a process
permanently, requiring the user to manually kill the process.
These activities can be set to occur after a set period of time (plus or minus a jitter)
and can be set to only affect a certain percentage of target processes.
$ am plan myplanid config Process add -h
usage: plan myplanid config Process add [-h] [--verbose] -n
PROCESS_NAME [-p] [-F FREQUENCY]
[-j JITTER] [-i INSTANCE] [-d DELAY]
[-r] -f {delay,kill,lock}
Add a new task
optional arguments:
-h, --help show this help message and exit
--verbose, -v Specify multiple times for more output
-n PROCESS_NAME, --process_name PROCESS_NAME
Target process name
-p, --periodic Continue processing more than an single instance
-F FREQUENCY, --frequency FREQUENCY
Percentage of time this will run (range 0-100)
-j JITTER, --jitter JITTER
Number of seconds of jitter (0 is no jitter)
-i INSTANCE, --instance INSTANCE
Maximum number of instances running concurrently
-d DELAY, --delay DELAY
Number of seconds to delay execution of the configured
action
-r, --running Exclude running instances - default-include running
and launching processes
-f {delay,kill,lock}, --feature {delay,kill,lock}
Features: delay, kill, lock
Each task of the Process gremlin (of which there can be multiple) will target one
process with one “feature” (ie, kill, delay, or lock). If –p is provided each process
with the given name that starts will be potentially targeted. If a –F frequency is
given then approximately F out of every 100 started processes will be affected.
37
SECRET//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh